CVE-2024-3962: Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file
The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppomuploadfile function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires the PPOM Pro plugin to be installed along with a WooCommerce product that contains a file upload field to retrieve the correct nonce.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3962?
CVE-2024-3962 is classified as a high severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-3962?
To fix CVE-2024-3962, update the Product Addons & Fields for WooCommerce plugin to version 32.0.19 or later.
Who is affected by CVE-2024-3962?
CVE-2024-3962 affects all versions of the Product Addons & Fields for WooCommerce plugin up to and including 32.0.18.
What type of attack is possible with CVE-2024-3962?
CVE-2024-3962 allows unauthenticated attackers to upload arbitrary files to the server.
Is user authentication required to exploit CVE-2024-3962?
No, CVE-2024-3962 can be exploited by unauthenticated users, making it especially dangerous.