CVE-2024-3962: Malicious File Upload
First published: Fri Apr 26 2024(Updated: )
The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires the PPOM Pro plugin to be installed along with a WooCommerce product that contains a file upload field to retrieve the correct nonce.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Themeisle PPOM for WooCommerce | <32.0.19 | |
| WordPress Addons & Fields for WooCommerce | <=32.0.18 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-3962?
CVE-2024-3962 is classified as a high severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-3962?
To fix CVE-2024-3962, update the Product Addons & Fields for WooCommerce plugin to version 32.0.19 or later.
Who is affected by CVE-2024-3962?
CVE-2024-3962 affects all versions of the Product Addons & Fields for WooCommerce plugin up to and including 32.0.18.
What type of attack is possible with CVE-2024-3962?
CVE-2024-3962 allows unauthenticated attackers to upload arbitrary files to the server.
Is user authentication required to exploit CVE-2024-3962?
No, CVE-2024-3962 can be exploited by unauthenticated users, making it especially dangerous.
- agent/weakness
- agent/references
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/remedy
- agent/softwarecombine
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup-request
- agent/tags
- vendor/themeisle
- canonical/themeisle ppom for woocommerce
- vendor/wordpress
- canonical/wordpress addons & fields for woocommerce