PT-2024-16360 · WordPress · Wp Membership

Tonn · Published 2024-11-09 · Updated 2024-11-14 · CVE-2024-10547

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Membership plugin for WordPress versions up to, and including, 1.6.2

Description The WP Membership plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the user profile image upload() function. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Recommendations For WP Membership plugin for WordPress versions up to, and including, 1.6.2: Update to the latest version to secure your site. As a temporary workaround, consider disabling the user profile image upload() function until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-10547

Affected Products

Wp Membership

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-10547 · Security Note
• https://t.me/cvedetector/10284 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/664e6e2a-faa1-4609-b250-d7e94c5d5a04?source=cve · Note
• https://twitter.com/transilienceai/status/1856567138124767387 · Twitter Post
• https://t.me/latest_high_impact_cve/1476 · Telegram Post
• https://twitter.com/cracbot/status/1856940190973276627 · Twitter Post
• https://twitter.com/CveFindCom/status/1855158843342237845 · Twitter Post
• https://twitter.com/transilienceai/status/1856567145540301248 · Twitter Post
• https://twitter.com/CVEnew/status/1855156238629146694 · Twitter Post
• https://twitter.com/transilienceai/status/1856567151932424546 · Twitter Post
• https://codecanyon.net/item/wp-membership/10066554 · Note