CVE-2024-11635: WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution
Published Jan 8, 2025
·Updated
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfuABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server.
Affected Software
2 affected components
WordPress File Upload<=4.24.12
Iptanus Wordpress File Upload Wordpress<4.24.15
Event History
Jan 8, 2025
CVE Published
via MITRE·07:18 AM
Data Sourced
via MITRE·07:18 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-11635?
CVE-2024-11635 has a critical severity rating due to its potential for remote code execution.
2
How do I fix CVE-2024-11635?
To fix CVE-2024-11635, update the WordPress File Upload plugin to version 4.24.13 or later.
3
Who is affected by CVE-2024-11635?
All users of the WordPress File Upload plugin up to and including version 4.24.12 are affected by CVE-2024-11635.
4
What type of vulnerability is CVE-2024-11635?
CVE-2024-11635 is identified as a remote code execution vulnerability.
5
Can CVE-2024-11635 be exploited by authenticated users?
No, CVE-2024-11635 can be exploited by unauthenticated attackers.