CVE-2024-10392

critical · 9.8

The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' function in all versions up to, and including, 1.8.89. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

9.8

CVSS

15.0%

EPSS (exploit prob.)

97th

EPSS percentile

2024-10-31

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

References

https://plugins.trac.wordpress.org/changeset/3176122/gpt3-ai-content-generator#file508
https://www.wordfence.com/threat-intel/vulnerabilities/id/cd8a45c9-ca48-4ea6-b34e-f05206f16155?source=cve

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-10392