CVE-2024-12853: Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12853?
CVE-2024-12853 is rated as a high severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-12853?
To fix CVE-2024-12853, update the Modula Image Gallery plugin to version 2.11.11 or later, where the issue has been resolved.
Who is affected by CVE-2024-12853?
CVE-2024-12853 affects all versions of the Modula Image Gallery plugin up to and including 2.11.10 that allow authenticated users with Author-level access.
What type of attacks can exploit CVE-2024-12853?
CVE-2024-12853 can be exploited by authenticated attackers to upload arbitrary files, potentially leading to code execution or website compromise.
What is the main issue with CVE-2024-12853?
The main issue with CVE-2024-12853 is the lack of proper file type validation during the zip upload functionality, allowing dangerous files to be uploaded.