CVE-2024-6828: Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting
The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the ReduxColorSchemeImport function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated attackers to upload JSON files, which can be used to conduct stored cross-site scripting attacks and, in some rare cases, when the wpfilesystem fails to initialize - to Remote Code Execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6828?
CVE-2024-6828 has a high severity level due to the risk of unauthenticated JSON file uploads.
How do I fix CVE-2024-6828?
To fix CVE-2024-6828, update the Redux Framework plugin to version 4.4.18 or later, where the vulnerability has been addressed.
Who is affected by CVE-2024-6828?
CVE-2024-6828 affects users running versions 4.4.12 to 4.4.17 of the Redux Framework plugin for WordPress.
What is the impact of CVE-2024-6828?
The impact of CVE-2024-6828 allows attackers to upload malicious JSON files, potentially leading to site compromise.
Is CVE-2024-6828 being actively exploited?
There have been reports indicating that CVE-2024-6828 may be actively exploited in the wild.