CVE-2024-10627

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-10627
The WooCommerce Support Ticket System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 17.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS

No CVSS.

References
Link Resource
https://codecanyon.net/item/woocommerce-support-ticket-system/17930050 Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac218f6-0bfa-480c-9159-d75a027022ba?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vanquish:woocommerce_support_ticket_system:*:*:*:*:*:wordpress:*:*
History

05 Jun 2025, 16:59

Type Values Removed Values Added
First Time Vanquish woocommerce Support Ticket System
Vanquish
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : unknown
CWE CWE-434
References () https://codecanyon.net/item/woocommerce-support-ticket-system/17930050 - () https://codecanyon.net/item/woocommerce-support-ticket-system/17930050 - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac218f6-0bfa-480c-9159-d75a027022ba?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/1ac218f6-0bfa-480c-9159-d75a027022ba?source=cve - Third Party Advisory
CPE cpe:2.3:a:vanquish:woocommerce_support_ticket_system:*:*:*:*:*:wordpress:*:*

09 Nov 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-09 04:15

Updated : 2025-06-05 16:59

NVD link : CVE-2024-10627

Mitre link : CVE-2024-10627

JSON object : View

Products Affected

vanquish

  • woocommerce_support_ticket_system
CWE

No CWE.