Unauthenticated JSON File Uploads Vulnerability Affects Redux Framework Plugin

CVE-2024-6828

What is CVE-2024-6828?

The Redux Framework plugin for WordPress contains a vulnerability that allows unauthenticated users to upload JSON files due to inadequate authorization checks within the Redux_Color_Scheme_Import function. This security loophole empowers malicious actors to perform stored cross-site scripting (XSS) attacks, which can be particularly damaging in the context of website integrity and user data. In rare scenarios, if the wp_filesystem initialization process fails, it could even lead to remote code execution (RCE), thereby posing severe risks to affected WordPress installations.

References