CVE-2024-7384: AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acymextractArchive function in all versions up to, and including, 9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7384?
CVE-2024-7384 is a high severity vulnerability due to its ability to allow arbitrary file uploads.
How do I fix CVE-2024-7384?
To fix CVE-2024-7384, upgrade the AcyMailing plugin to version 9.8.0 or later where the vulnerability is addressed.
What versions of AcyMailing are affected by CVE-2024-7384?
All versions of AcyMailing up to and including 9.7.2 are affected by CVE-2024-7384.
What impact does CVE-2024-7384 have on my website?
CVE-2024-7384 could potentially allow attackers to upload malicious files, compromising the security of your website.
Is there a workaround for CVE-2024-7384 until I can update?
While the best solution is to update, you can restrict file uploads by adjusting user permissions or settings in your WordPress installation.