PT-2025-9827 · WordPress · Designthemes Core Features

Tonn · Publicado 2025-03-05 · Atualizado 2025-03-06 · CVE-2024-13471

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions DesignThemes Core Features plugin for WordPress versions prior to 4.7

Description The issue allows unauthorized access to data due to a missing capability check on the dt process imported file function. This makes it possible for unauthenticated attackers to read arbitrary files on the underlying operating system.

Recommendations For versions prior to 4.7, update to version 4.7 or later to resolve the issue. As a temporary workaround, consider disabling the dt process imported file function until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2024-13471

Produtos afetados

Designthemes Core Features

Referências · 8

• https://twitter.com/cybercronai/status/1897369182062219267 · Publicação no Twitter
• https://t.me/cvenotify/113553 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1897351919632273559 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1897506928894382336 · Publicação no Twitter
• https://themeforest.net/item/lms-learning-management-system-education-lms-wordpress-theme/7867581 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/1729d0de-1f5f-4349-b592-5841d01ed33a?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-13471 · Nota de Segurança
• https://t.me/cvedetector/19626 · Publicação no Telegram