CVE-2024-3242: Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload
The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Version 2.4.44 prevents the upload of files ending in .sh and .php. Version 2.4.45 fully patches the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3242?
CVE-2024-3242 has a high severity rating due to the potential for arbitrary file uploads by authenticated attackers.
How do I fix CVE-2024-3242?
To fix CVE-2024-3242, update the Brizy Page Builder plugin to the latest version, 2.4.45 or higher.
Who is affected by CVE-2024-3242?
CVE-2024-3242 affects all versions of the Brizy Page Builder plugin up to and including 2.4.43.
What vulnerabilities does CVE-2024-3242 exploit?
CVE-2024-3242 exploits the lack of file extension validation, allowing for potentially malicious file uploads.
Can CVE-2024-3242 be exploited without authentication?
No, CVE-2024-3242 requires an authenticated user to exploit the vulnerability.