PT-2024-7645 · WordPress · Ai Power: Complete Ai Pack

Dale Mavers + 1 · Published 2024-10-26 · Updated 2024-11-06 · CVE-2024-10392

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AI Power: Complete AI Pack plugin for WordPress versions 1.8.89 and earlier

Description The issue is related to arbitrary file uploads due to missing file type validation in the handle image upload function. This allows unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible. The estimated number of potentially affected devices worldwide is over 10,000 sites.

Recommendations For versions 1.8.89 and earlier, update to the latest version to mitigate the risk of remote code execution. As a temporary workaround, consider disabling the handle image upload function until a patch is available. Restrict access to the vulnerable plugin to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2024-09086

CVE-2024-10392

Affected Products

Ai Power: Complete Ai Pack

References · 20

• https://nvd.nist.gov/vuln/detail/CVE-2024-10392 · Security Note
• https://bdu.fstec.ru/vul/2024-09086 · Security Note
• https://t.me/cvenotify/100128 · Telegram Post
• https://twitter.com/transilienceai/status/1853300369474134024 · Twitter Post
• https://twitter.com/transilienceai/status/1853300376071729165 · Twitter Post
• https://twitter.com/vuldb/status/1851891995503136858 · Twitter Post
• https://t.me/pentestingnews/52810 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3176122/gpt3-ai-content-generator#file508 · Note
• https://twitter.com/CandidTodayTech/status/1851943200534954260 · Twitter Post
• https://twitter.com/Brandefense/status/1853729333598171225 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/cd8a45c9-ca48-4ea6-b34e-f05206f16155?source=cve · Note
• https://twitter.com/CveFindCom/status/1851867032360259710 · Twitter Post
• https://asec.ahnlab.com/en/84202 · Note
• https://twitter.com/fridaysecurity/status/1851907940875145472 · Twitter Post
• https://twitter.com/CVEnew/status/1851861953011913036 · Twitter Post