Authenticated Attackers Can Exploit Plugin Vulnerability to Execute Remote Code

CVE-2024-8480

Summary

The Sirv plugin for WordPress is susceptible to a vulnerability that permits unauthorized modification of data. This occurs due to a missing capability check in the 'sirv_save_prevented_sizes' function, making all versions up to and including 7.2.7 affected. Authenticated users with Contributor-level permissions and higher can exploit the flaw in the 'sirv_upload_file_by_chunks_callback' function. This function fails to perform adequate file type validation, enabling attackers to upload arbitrary files onto the server of the affected site, thereby potentially leading to remote code execution.

References