PT-2025-7819 · WordPress · Wordpress File Upload

Tim Coen · Published 2025-02-25 · Updated 2025-02-25 · CVE-2024-13494

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress File Upload plugin versions up to 4.25.2

Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wfu file details function. This allows unauthenticated attackers to modify user data details associated with uploaded files by tricking a site administrator into performing an action, such as clicking on a link.

Recommendations For WordPress File Upload plugin versions up to 4.25.2, update to a version later than 4.25.2 to resolve the issue. As a temporary workaround, consider restricting access to the wfu file details function to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-13494

Affected Products

Wordpress File Upload

References · 7

• https://osv.dev/vulnerability/CVE-2024-13494 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13494 · Security Note
• https://plugins.trac.wordpress.org/changeset/3241028/wp-file-upload · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/595a6ab3-0731-4ef4-a385-5dfebbd917f4?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1894310197209768296 · Twitter Post
• https://twitter.com/CVEnew/status/1894293864556761181 · Twitter Post
• https://t.me/cvedetector/18858 · Telegram Post