Unrestricted Upload of File with Dangerous Type Vulnerability Affects WP Media Folder
CVE-2024-25909

8.8HIGH

Key Information:

Vendor

WordPress
Status
WP Media Folder
Vendor
CVE Published:
26 February 2024

What is CVE-2024-25909?

The vulnerability in JoomUnited's WP Media Folder allows for unrestricted file uploads with potentially dangerous file types, posing a significant security risk to WordPress sites. Attackers can exploit this weakness to upload malicious files, which could lead to unauthorized access, data breaches, or site defacement. All versions of WP Media Folder up to and including 5.7.2 are affected, making it critical for users to ensure their installations are adequately secured and updated.

Affected Version(s)

WP Media folder <= 5.7.2

References

https://patchstack.com/database/vulnerability/wp-media-fo...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dave Jong (Patchstack)
.