CVE-2024-9047

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-9047
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
CVSS

No CVSS.

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3164449/wp-file-upload Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:iptanus:wordpress_file_upload:*:*:*:*:*:wordpress:*:*
History

12 Mar 2025, 18:03

Type Values Removed Values Added
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=cve - Third Party Advisory
References () https://plugins.trac.wordpress.org/changeset/3164449/wp-file-upload - () https://plugins.trac.wordpress.org/changeset/3164449/wp-file-upload - Patch
CPE cpe:2.3:a:iptanus:wordpress_file_upload:*:*:*:*:*:wordpress:*:*
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : unknown
CWE CWE-22
First Time Iptanus
Iptanus wordpress File Upload

12 Oct 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-12 07:15

Updated : 2025-03-12 18:03

NVD link : CVE-2024-9047

Mitre link : CVE-2024-9047

JSON object : View

Products Affected

iptanus

  • wordpress_file_upload
CWE

No CWE.