CVE-2024-7484: CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload
The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handleuploadedfiles' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7484?
CVE-2024-7484 is rated as a high severity vulnerability due to the potential for arbitrary file uploads.
How do I fix CVE-2024-7484?
To fix CVE-2024-7484, update the CRM Perks Forms plugin to version 1.1.4 or later.
Who is affected by CVE-2024-7484?
Authenticated users with administrator-level capabilities on WordPress sites using versions of CRM Perks Forms up to 1.1.3 are affected by CVE-2024-7484.
What type of vulnerability is CVE-2024-7484?
CVE-2024-7484 is an arbitrary file upload vulnerability caused by insufficient file validation.
When was CVE-2024-7484 discovered?
CVE-2024-7484 was reported and added to the NVD database, making users aware of the potential exploit.