PT-2024-28030 · WordPress · Click To Chat – Holithemes

Haidv35

·

Published

2024-05-02

·

Updated

2024-05-02

·

CVE-2024-3849

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Click to Chat – HoliThemes plugin for WordPress versions up to, and including, 3.35
Description The issue allows authenticated attackers with contributor access or above to include and execute arbitrary files on the server. This enables the execution of any PHP code in those files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution. This is particularly concerning in cases where images and other “safe” file types can be uploaded and included.
Recommendations For versions up to, and including, 3.35, update to a version higher than 3.35 to resolve the issue. As a temporary workaround, consider restricting contributor access to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2024-3849

Affected Products

Click To Chat – Holithemes