CVE-2024-9108: Wechat Social login <= 1.3.0 - Unauthenticated Arbitrary File Upload
The Wechat Social login plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'convertremoteimagetolocal' function in versions up to, and including, 1.3.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9108?
CVE-2024-9108 is classified as a high severity vulnerability due to the risk of arbitrary file uploads.
How do I fix CVE-2024-9108?
To fix CVE-2024-9108, update the Wechat Social login plugin for WordPress to version 1.3.1 or later, which includes the necessary security patches.
Who is affected by CVE-2024-9108?
CVE-2024-9108 affects users of the Wechat Social login plugin for WordPress versions 1.3.0 and below.
What type of attack can be executed via CVE-2024-9108?
CVE-2024-9108 allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to further exploitation.
Which function in the Wechat Social login plugin is vulnerable in CVE-2024-9108?
The vulnerable function in CVE-2024-9108 is 'convert_remoteimage_to_local', which has insufficient file type validation.