CVE-2024-13494: WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data details associated with uploaded files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-13494?
CVE-2024-13494 is classified as a high severity vulnerability due to the potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2024-13494?
To fix CVE-2024-13494, update the WordPress File Upload plugin to version 4.25.3 or later.
Who is affected by CVE-2024-13494?
CVE-2024-13494 affects all versions of the WordPress File Upload plugin up to and including version 4.25.2.
What type of vulnerability is CVE-2024-13494?
CVE-2024-13494 is a Cross-Site Request Forgery (CSRF) vulnerability.
Can unauthenticated users exploit CVE-2024-13494?
Yes, unauthenticated attackers can exploit CVE-2024-13494 due to the lack of proper nonce validation.