Unrestricted Upload of File with Dangerous Type Vulnerability Affects WP Media Folder
CVE-2024-25909

9.9CRITICAL

Key Information:

Vendor
WordPress
Status
WP Media Folder
Vendor
CVE Published:
26 February 2024

Summary

The vulnerability in JoomUnited's WP Media Folder allows for unrestricted file uploads with potentially dangerous file types, posing a significant security risk to WordPress sites. Attackers can exploit this weakness to upload malicious files, which could lead to unauthorized access, data breaches, or site defacement. All versions of WP Media Folder up to and including 5.7.2 are affected, making it critical for users to ensure their installations are adequately secured and updated.

Affected Version(s)

WP Media folder <= 5.7.2

References

https://patchstack.com/database/vulnerability/wp-media-fo...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dave Jong (Patchstack)
.