File Upload Vulnerability in SuitePlugins Video & Photo Gallery
CVE-2024-54370

9.9CRITICAL

Key Information:

Vendor

WordPress
Status
Video & Photo Gallery For Ultimate Member
Vendor
CVE Published:
16 December 2024

What is CVE-2024-54370?

CVE-2024-54370 is a critical vulnerability in the SuitePlugins Video & Photo Gallery for Ultimate Member that allows malicious users to perform an unrestricted upload of files with dangerous types. This flaw could enable attackers to upload web shells to the web server, posing significant security risks. It impacts versions from n/a through 1.1.0. Website administrators using this plugin are highly encouraged to apply patches and monitor their systems for any suspicious activity immediately.

Affected Version(s)

Video & Photo Gallery for Ultimate Member <= 1.1.0

References

https://patchstack.com/database/wordpress/plugin/gallery-...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

theviper17 (Patchstack Alliance)
.