PT-2024-37533 · WordPress · Funnelforms Free

István Márton · Published 2024-08-27 · Updated 2024-09-12 · CVE-2024-6312

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Funnelforms Free plugin for WordPress versions up to, and including, 3.7.3.2

Description: The issue is related to arbitrary file deletion due to the plugin not properly validating a file or its path prior to deletion. This is made possible via the af2DeleteFontFile function, allowing unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can lead to site takeover and remote code execution.

Recommendations: For versions up to, and including, 3.7.3.2, update to a version higher than 3.7.3.2 to resolve the issue. As a temporary workaround, consider disabling the af2DeleteFontFile function until a patch is available. Restrict access to sensitive files, such as wp-config.php, to minimize the risk of exploitation.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-6312

Affected Products

Funnelforms Free

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6312 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6312 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/3e815531-f966-44a1-a037-8077a40c83b0?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1828750890917851520 · Twitter Post
• https://t.me/cvedetector/4304 · Telegram Post
• https://t.me/cvenotify/94383 · Telegram Post
• https://twitter.com/CVEnew/status/1828687069608337781 · Twitter Post
• https://plugins.trac.wordpress.org/browser/funnelforms-free/tags/3.7.3.2/admin/menu_ajax_functions/formularbuilder_fonts.php#L59 · Note
• https://plugins.trac.wordpress.org/browser/funnelforms-free/tags/3.7.4.1/admin/menu_ajax_functions/formularbuilder_fonts.php?rev=3141470#L17 · Note