PT-2024-33628 · Elementor · Custom Icons For Elementor

Tahu.Datar · Published 2024-10-23 · Updated 2024-10-25 · CVE-2024-49676

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Custom Icons for Elementor versions 0.3.3 and earlier

Description The issue allows for the unrestricted upload of files with dangerous types, which can lead to uploading a web shell to a web server.

Recommendations For versions 0.3.3 and earlier, update to a version that contains a fix for this issue, as the current version allows for the upload of malicious files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-49676

Affected Products

Custom Icons For Elementor

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2024-49676 · Security Note
• https://patchstack.com/database/vulnerability/custom-icons-for-elementor/wordpress-custom-icons-for-elementor-plugin-0-3-3-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/8709 · Telegram Post
• https://patchstack.com/database/Wordpress/Plugin/custom-icons-for-elementor/vulnerability/wordpress-custom-icons-for-elementor-plugin-0-3-3-arbitrary-file-upload-vulnerability?_s_id=cve · Note