CVE-2024-9234: GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the installandactivatepluginfromexternal() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-9234?
CVE-2024-9234 has a medium severity level due to the risk of arbitrary file uploads.
How do I fix CVE-2024-9234?
To fix CVE-2024-9234, update the GutenKit plugin to version 2.1.1 or higher, where the vulnerability has been addressed.
What impact does CVE-2024-9234 have on my WordPress website?
CVE-2024-9234 allows attackers to upload malicious files, potentially compromising your WordPress site and server.
Which versions of GutenKit are affected by CVE-2024-9234?
CVE-2024-9234 affects GutenKit versions up to and including 2.1.0.
Is there a workaround for CVE-2024-9234 if I cannot update right away?
If you cannot update immediately, consider disabling the GutenKit plugin until a patch can be applied to mitigate the vulnerability.