CVE-2025-24650: WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

Q: What is the severity of CVE-2025-24650?

CVE-2025-24650 is classified as a high-severity vulnerability due to its potential for allowing remote code execution via uploaded web shells.

Q: How do I fix CVE-2025-24650?

To fix CVE-2025-24650, update the Themefic Tourfic plugin to version 2.15.4 or later, which addresses this vulnerability.

Q: What software is affected by CVE-2025-24650?

CVE-2025-24650 affects Themefic Tourfic versions up to and including 2.15.3.

Q: What is the impact of CVE-2025-24650?

The impact of CVE-2025-24650 includes the potential uploading of malicious files, enabling attackers to execute unauthorized commands on the server.

Q: What type of vulnerability is CVE-2025-24650?

CVE-2025-24650 is an unrestricted upload of file with dangerous type vulnerability.

Published Jan 24, 2025

Updated

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3.

Affected Software

3 affected components

Themefic Tourfic<=2.15.3

WordPress Tourfic<=2.15.3

Themefic Tourfic Wordpress<2.15.4

Remediation

Information

Update the WordPress Tourfic wordpress plugin to the latest available version (at least 2.15.4).

Event History

Jan 24, 2025

CVE Published

via MITRE·05:24 PM

Data Sourced

via MITRE·05:24 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-24650?

CVE-2025-24650 is classified as a high-severity vulnerability due to its potential for allowing remote code execution via uploaded web shells.

How do I fix CVE-2025-24650?

To fix CVE-2025-24650, update the Themefic Tourfic plugin to version 2.15.4 or later, which addresses this vulnerability.

What software is affected by CVE-2025-24650?