premio Vulnerabilities and Affected Products
Vulnerabilities associated with Folders Pro.
Products
Clear product- Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager6 vulnerabilities
- Chaty4 vulnerabilities
- Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce2 vulnerabilities
- Folders Pro2 vulnerabilities
- My Sticky Bar – Floating Notification Bar & Sticky Header (formerly myStickymenu)2 vulnerabilities
- My Sticky Elements2 vulnerabilities
- my_sticky_bar2 vulnerabilities
- Stars Testimonials — Responsive Reviews & Star Ratings2 vulnerabilities
- All-in-one Sticky Floating Contact Form, Call, Click to Chat, and 50+ Social Icon Tabs – My Sticky Elements1 vulnerability
- all_in_one_floating_contact_form_my_sticky_elements1 vulnerability
- Chaty (WordPress plugin)1 vulnerability
- Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty1 vulnerability
- floating_chat_widget1 vulnerability
- folders1 vulnerability
- folders_pro1 vulnerability
- My Sticky Bar1 vulnerability
- Stars Testimonials1 vulnerability
- testimonials1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-2024HIGH | Folders Pro <= 3.0.2 - Authenticated(Author+) Arbitrary File Upload via handle_folders_file_uploadThe Folders Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_folders_file_upload' function in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with author access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. CWE-22Jun 14, 2024 | CVSS8.8v3.1 | EPSS3.3% | PoCs18 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-2023MEDIUM | Folders <= 3.0 and Folders Pro <= 3.0.2 - Directory Traversal via handle_folders_file_uploadThe Folders and Folders Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.0 in Folders and 3.0.2 in Folders Pro via the 'handle_folders_file_upload' function. This makes it possible for authenticated attackers, with author access and above, to upload files to arbitrary locations on the server. CWE-22Jun 14, 2024 | CVSS4.3v3.1 | EPSS0.673% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |