CVE-2024-4389: Slider & Popup Builder by Depicter – Add Image Slider, Carousel Slider, Exit Intent Popup, Popup Modal, Coupon Popup, Post Slider Carousel <= 3.1.1 - Authenticated (Contributor+) Arbitrary File Upload
First published: Wed Aug 14 2024(Updated: )
The Slider and Carousel slider by Depicter plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadFile function in all versions up to, and including, 3.1.1. This makes it possible for authenticated attackers, with contributor access or higher, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Depicter Slider & Popup Builder | <=3.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/81f025da-c28c-4a80-8b4f-27dae07b2b04?source=cve
- https://plugins.trac.wordpress.org/browser/depicter/trunk/app/src/WordPress/FileUploaderService.php#L28
- https://plugins.trac.wordpress.org/changeset/3108589/depicter/trunk/app/src/WordPress/FileUploaderService.php
Frequently Asked Questions
What is the severity of CVE-2024-4389?
CVE-2024-4389 is considered a high severity vulnerability due to its potential for arbitrary file uploads by authenticated attackers.
How do I fix CVE-2024-4389?
To fix CVE-2024-4389, update the Depicter Slider & Popup Builder plugin to version 3.1.2 or later.
Who is affected by CVE-2024-4389?
CVE-2024-4389 affects all versions of the Depicter Slider & Popup Builder plugin up to and including 3.1.1.
What type of vulnerability is CVE-2024-4389?
CVE-2024-4389 is a vulnerability due to missing file type validation in the uploadFile function.
Can unauthenticated users exploit CVE-2024-4389?
No, only authenticated attackers with contributor access can exploit CVE-2024-4389.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/depicter
- canonical/depicter slider & popup builder