CVE-2024-11613: WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfufiledownloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and allowing a user-defined directory path. This makes it possible for unauthenticated attackers to execute code on the server.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-11613?
CVE-2024-11613 is considered a critical vulnerability due to its potential for Remote Code Execution.
How do I fix CVE-2024-11613?
To fix CVE-2024-11613, update the WordPress File Upload plugin to version 4.24.16 or later.
What types of attacks can CVE-2024-11613 facilitate?
CVE-2024-11613 can facilitate Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion attacks.
Which versions of the WordPress File Upload plugin are affected by CVE-2024-11613?
All versions of the WordPress File Upload plugin up to and including 4.24.15 are affected by CVE-2024-11613.
Who is the vendor of the affected WordPress File Upload plugin for CVE-2024-11613?
The vendor of the affected WordPress File Upload plugin is Iptanus.