CVE-2024-9047

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.

9.8

CVSS

93.3%

EPSS (exploit prob.)

100th

EPSS percentile

2024-10-12

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
iptanus	wordpress_file_upload	< 4.24.12

Check a specific version with /api/v1/cve/match.

References

https://plugins.trac.wordpress.org/changeset/3164449/wp-file-upload
https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=cve

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-9047