CVE-2024-9932

Published Oct 26, 2024

Last updated 5 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-9932 is an arbitrary file upload vulnerability found in the Wux Blog Editor plugin for WordPress. This flaw exists in the `wuxbt_insertImageNew` function across all versions up to and including 3.0.0. The vulnerability stems from insufficient validation of file types, which allows unauthenticated attackers to upload arbitrary files to the affected server. This unauthorized file upload can potentially lead to remote code execution on the compromised system.

Description: The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Source: security@wordfence.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@wordfence.com: CWE-434

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 9

References