CVE-2024-6451: AI Engine < 2.5.1 - Admin+ RCE
Published Aug 19, 2024
·Updated
AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logspath", allowing Administrators to change log filetypes from .log to .php.
Affected Software
3 affected components
Meowapps Ai Engine Wordpress<2.4.3
AI Engine AI Engine<2.4.3
AI Engine AI Engine<2.5.1
Event History
Aug 19, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2024-6451?
CVE-2024-6451 has a high severity due to its potential for remote code execution.
2
How do I fix CVE-2024-6451?
To fix CVE-2024-6451, update the AI Engine plugin to version 2.5.1 or later.
3
Who is affected by CVE-2024-6451?
CVE-2024-6451 affects users of the AI Engine WordPress plugin versions prior to 2.5.1.
4
What type of vulnerability is CVE-2024-6451?
CVE-2024-6451 is classified as a remote code execution vulnerability caused by log poisoning.
5
What causes CVE-2024-6451?
CVE-2024-6451 is caused by the AI Engine plugin failing to validate file extensions for log paths.