PT-2025-3241 · WordPress · Wp-Ultimate-Exporter

Webula · Published 2025-01-07 · Updated 2025-01-07 · CVE-2024-56278

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Ultimate Exporter versions prior to 2.9.2

Description The issue is related to improper control of code generation, allowing PHP remote file inclusion. This can be exploited due to a 'code injection' vulnerability in the WP Ultimate Exporter plugin.

Recommendations For versions prior to 2.9.2, update to version 2.9.2 to resolve the issue. As a temporary workaround, consider restricting access to vulnerable components of the WP Ultimate Exporter plugin until the update is applied.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-56278

Affected Products

Wp-Ultimate-Exporter

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-56278 · Security Note
• https://patchstack.com/database/wordpress/plugin/wp-ultimate-exporter/vulnerability/wordpress-wp-ultimate-exporter-plugin-2-9-1-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/1876585229357396313 · Twitter Post
• https://twitter.com/WhalersLtd/status/1876716875402355174 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/wp-ultimate-exporter/vulnerability/wordpress-wp-ultimate-exporter-plugin-2-9-1-remote-code-execution-rce-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/106560 · Telegram Post
• https://twitter.com/CVEnew/status/1876587679967519168 · Twitter Post