Arbitrary File Creation Vulnerability in WebinarPress Plugin by WordPress
CVE-2024-11270

8.8HIGH

Key Information:

Vendor
Wordpress
Status
WordPress Webinar Plugin – Webinarpress
Vendor
CVE Published:
8 January 2025

Summary

The WebinarPress plugin for WordPress is susceptible to an arbitrary file creation flaw that arises from an absent capability check within the 'sync-import-imgs' function and inadequate file type validation across all versions up to and including 1.33.24. This vulnerability enables authenticated attackers with subscriber-level access or higher to generate arbitrary files, potentially resulting in remote code execution.

Affected Version(s)

WordPress Webinar Plugin – WebinarPress * <= 1.33.24

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3216237/wp-w...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucio Sá
.