PT-2025-18752 · WordPress · Wordpress

Lucio Sá · Published 2025-05-02 · Updated 2025-05-07 · CVE-2024-13418

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress (affected versions not specified)

Description The issue is related to a missing capability check on the ajaxUploadFonts() function in various WordPress plugins and themes, allowing authenticated attackers with Subscriber-level access and above to upload arbitrary files. This can potentially lead to remote code execution. The issue was escalated to Envato over two months ago and, while partially patched, remains vulnerable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-13418

Affected Products

Wordpress

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-13418 · Security Note
• https://osv.dev/vulnerability/CVE-2024-13418 · Vendor Advisory
• https://twitter.com/CVEnew/status/1918181319991017781 · Twitter Post
• https://twitter.com/cybercronai/status/1918368775650296031 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/bced4547-3264-43dc-8bb1-89a06f74ccbd?source=cve · Note
• https://t.me/cvetracker/22909 · Telegram Post
• https://twitter.com/cracbot/status/1920071196181213310 · Twitter Post
• https://t.me/cvedetector/24321 · Telegram Post
• https://twitter.com/vulns_space/status/1918171468753522718 · Twitter Post
• https://t.me/cvenotify/120599 · Telegram Post
• https://themeforest.net/item/beyot-wordpress-real-estate-theme/19514964 · Note
• https://twitter.com/CveFindCom/status/1918154234140250550 · Twitter Post