Arbitrary File Upload Vulnerability in AcyMailing Plugin

CVE-2024-7384

8.8HIGH

Key Information

Vendor
Acyba
Status
Acymailing – An Ultimate Newsletter Plugin And Marketing Automation Solution For WordPress
Vendor
CVE Published:
22 August 2024

Summary

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive function in all versions up to, and including, 9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected Version(s)

AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 9.7.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/acymailing/tru...
https://wordpress.org/plugins/acymailing/#developers

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Arkadiusz Hydzik
.