PT-2024-26345 · Unknown · Download Plugins/Themes In Zip From Dashboard

Gen Sato · Published 2024-05-22 · Updated 2024-08-12 · CVE-2024-35162

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Download Plugins and Themes from Dashboard versions prior to 1.8.6

Description A path traversal issue exists, allowing a remote authenticated attacker with switch themes privilege to obtain arbitrary files on the server if exploited.

Recommendations For versions prior to 1.8.6, update to version 1.8.6 or later to resolve the issue. As a temporary workaround, consider restricting the switch themes privilege to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-35162

Affected Products

Download Plugins/Themes In Zip From Dashboard

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-35162 · Security Note
• https://t.me/cvenotify/80636 · Telegram Post
• https://jvn.jp/en/jp/JVN85380030 · Note
• https://wordpress.org/plugins/download-plugins-dashboard · Note
• https://twitter.com/CVEnew/status/1793284087341605230 · Twitter Post
• https://t.me/cvenotify/90133 · Telegram Post