3D FlipBook Plugin Vulnerable to Arbitrary File Uploads

CVE-2024-9849

8.8HIGH

Key Information

Vendor
Creativeinteractivemedia
Status
Real3d Flipbook Lite – 3d Flipbook, PDF Viewer, PDF Embedder
Vendor
CVE Published:
16 November 2024

Summary

The 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'r3dfb_save_thumbnail_callback' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected Version(s)

Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder <= 4.6

Refferences

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/real3d-flipboo...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Aitor F
.