PT-2024-18636 · WordPress · Folders Pro

Colin Xu · Published 2024-06-14 · Updated 2024-06-17 · CVE-2024-2024

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Folders Pro plugin for WordPress versions up to, and including, 3.0.2

Description The issue arises from missing file type validation in the handle folders file upload function, allowing authenticated attackers with author access or higher to upload arbitrary files to the server. This could potentially lead to remote code execution.

Recommendations For versions up to, and including, 3.0.2, update to a version that includes a fix for the missing file type validation in the handle folders file upload function. As a temporary workaround, consider disabling the handle folders file upload function until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-2024

Affected Products

Folders Pro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-2024 · Security Note
• https://twitter.com/CVEnew/status/1801673803594141723 · Twitter Post
• https://plugins.trac.wordpress.org/browser/folders/tags/3.0/includes/media.replace.php#L1311 · Note
• https://t.me/cvenotify/83301 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/fa1d953f-6a5c-46af-a1a5-2c4f90da679a?source=cve · Note