CVE-2024-10470
CRITICALWPLMS Learning Management System for WordPress <= 4.962 - Arbitrary File Read/Deletion via Path Validation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-10470. PoCs published by 0xshoriful, RandomRobbieBF.
AI-analyzed exploit summary The repository contains a functional proof-of-concept for CVE-2024-10470, demonstrating an unauthenticated arbitrary file read and deletion vulnerability in WPLMS Learning Management System for WordPress <= 4.962. The PoC includes a crafted HTTP POST request targeting the 'envato-setup-export.php' endpoint to exploit insufficient file path validation.
Description
The WPLMS Learning Management System for WordPress, WordPress LMS theme for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions checks in the readfile and unlink functions in all versions up to, and including, 4.962. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The theme is vulnerable even when it is not activated.
Exploits (2)
The repository contains a functional proof-of-concept for CVE-2024-10470, demonstrating an unauthenticated arbitrary file read and deletion vulnerability in WPLMS Learning Management System for WordPress <= 4.962. The PoC includes a crafted HTTP POST request targeting the 'envato-setup-export.php' endpoint to exploit insufficient file path validation.
The repository contains a functional proof-of-concept for CVE-2024-10470, demonstrating an unauthenticated arbitrary file read and deletion vulnerability in the WPLMS Learning Management System for WordPress. The exploit leverages insufficient file path validation in the `envato-setup-export.php` endpoint to delete arbitrary files, potentially leading to remote code execution.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H