CVE-2024-8671: WooEvents <= 4.1.2 - Unauthenticated Arbitrary File Overwrite
The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to overwrite arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8671?
CVE-2024-8671 is rated as a high severity vulnerability due to its potential for arbitrary file overwrite.
How do I fix CVE-2024-8671?
To fix CVE-2024-8671, upgrade the WooEvents plugin to version 4.1.3 or later.
Who is affected by CVE-2024-8671?
CVE-2024-8671 affects all versions of the WooEvents - Calendar and Event Booking plugin for WordPress up to and including version 4.1.2.
What type of vulnerability is CVE-2024-8671?
CVE-2024-8671 is classified as an arbitrary file overwrite vulnerability.
Can CVE-2024-8671 be exploited by unauthorized users?
Yes, CVE-2024-8671 can be exploited by unauthenticated attackers due to insufficient file path validation.