CVE-2024-1205: Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload
The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the nouvellouploadcsvfile function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1205?
CVE-2024-1205 is classified as a critical vulnerability due to the potential for arbitrary file uploads.
How do I fix CVE-2024-1205?
To fix CVE-2024-1205, update the Management App for WooCommerce to version 1.2.1 or higher, which addresses the file type validation issues.
What versions of the Management App for WooCommerce are affected by CVE-2024-1205?
All versions of the Management App for WooCommerce up to and including 1.2.0 are affected by CVE-2024-1205.
What is the impact of CVE-2024-1205?
CVE-2024-1205 can lead to unauthorized access and potential exploitation by allowing malicious users to upload arbitrary files.
How can I determine if my site is vulnerable to CVE-2024-1205?
Check if you are using the Management App for WooCommerce version 1.2.0 or lower, as these versions are vulnerable to CVE-2024-1205.