Unauthenticated Attackers Can Upload Arbitrary Files on Affected Site's Server

CVE-2024-10820

Summary

The WooCommerce Upload Files plugin for WordPress has a significant security vulnerability due to inadequate file type validation in its upload_files() function. This flaw is present in all versions up to and including 84.3, making it susceptible to unauthorized file uploads by unauthenticated users. Attackers can exploit this vulnerability to upload malicious files onto the server of affected websites, potentially enabling remote code execution. Website administrators using this plugin should take immediate action to secure their installations and mitigate the risk associated with this vulnerability.

References