PT-2024-39168 · WordPress · Wooevents

Tonn · Published 2024-09-23 · Updated 2024-09-26 · CVE-2024-8671

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WooEvents - Calendar and Event Booking plugin for WordPress versions up to, and including, 4.1.2

Description: The WooEvents - Calendar and Event Booking plugin for WordPress is vulnerable to arbitrary file overwrite due to insufficient file path validation in the inc/barcode.php file. This makes it possible for unauthenticated attackers to overwrite arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted, such as wp-config.php.

Recommendations: For versions up to, and including, 4.1.2, update to a version higher than 4.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the inc/barcode.php file until a patch is available. Avoid using the vulnerable file path validation in the inc/barcode.php file until the issue is resolved.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-8671

Affected Products

Wooevents

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-8671 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8671 · Vendor Advisory
• https://twitter.com/cracbot/status/1839183222099542473 · Twitter Post
• https://t.me/cvenotify/95784 · Telegram Post
• https://t.me/latest_high_impact_cve/1197 · Telegram Post
• https://twitter.com/CVEnew/status/1838422002719416785 · Twitter Post
• https://twitter.com/CveFindCom/status/1838420904373588094 · Twitter Post
• https://codecanyon.net/item/wooevents-calendar-and-event-booking/15598178 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3d7af96a-5a3c-4291-a369-f6ed78f72a3f?source=cve · Note
• https://twitter.com/SecPod/status/1838465194294427714 · Twitter Post
• https://t.me/cvedetector/6237 · Telegram Post