PT-2024-39561 · WordPress · Mfolio Lite

Francesco Carlucci · Published 2024-11-05 · Updated 2024-11-09 · CVE-2024-9307

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mFolio Lite plugin for WordPress version 1.2.1 and earlier

Description The issue is due to a missing capability check, allowing authenticated attackers with Author-level access and above to inject arbitrary web scripts in pages or upload arbitrary EXE files on the affected site's server. This may make remote code execution possible if the attacker can also gain access to run the .exe file, or trick a site visitor into downloading and running the .exe file.

Recommendations For versions 1.2.1 and earlier, update to a version that includes a fix for the missing capability check to prevent arbitrary file uploads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-9307

Affected Products

Mfolio Lite

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-9307 · Security Note
• https://osv.dev/vulnerability/CVE-2024-9307 · Vendor Advisory
• https://wordpress.org/plugins/mfolio-lite/#developers · Note
• https://twitter.com/CveFindCom/status/1854056505860923760 · Twitter Post
• https://twitter.com/UndercodeNews/status/1855084660788707454 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3195835%40mfolio-lite%2Ftrunk&old=2792814%40mfolio-lite%2Ftrunk · Note
• https://t.me/latest_high_impact_cve/1457 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3b4012dd-7c0a-45f1-8ada-8f9dc6867e1e?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1854237570298716597 · Twitter Post
• https://t.me/cvedetector/9991 · Telegram Post
• https://t.me/cvenotify/100769 · Telegram Post
• https://twitter.com/CVEnew/status/1854054687483576736 · Twitter Post