CVE-2024-8242: MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload
The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the updateuserprofile() function in all versions up to, and including, 4.15.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files (not including PHP files) on the affected site's server which may make remote code execution possible. This can be paired with a registration endpoint for unauthenticated users to exploit the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8242?
CVE-2024-8242 is classified as a high-severity vulnerability due to its potential for arbitrary file uploads.
How do I fix CVE-2024-8242?
To fix CVE-2024-8242, update the MStore API plugin to version 4.15.4 or later.
What versions are affected by CVE-2024-8242?
CVE-2024-8242 affects all versions of the MStore API plugin up to and including 4.15.3.
What is the impact of CVE-2024-8242?
The impact of CVE-2024-8242 allows authenticated users to upload arbitrary files, potentially leading to remote code execution.
Who is impacted by CVE-2024-8242?
Users of the MStore API plugin for WordPress who have versions up to 4.15.3 installed are impacted by CVE-2024-8242.