CVE-2024-1205

HIGH

Wemanage < 1.2.3 - Unrestricted File Upload

Title source: rule

Description

The Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the nouvello_upload_csv_file function in all versions up to, and including, 1.2.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

References (5)

Core 5

Core References

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3056070%40wemanage-app-worker&new=3056070%40wemanage-app-worker&sfp_email=&sfph_mail=

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3057589%40wemanage-app-worker&new=3057589%40wemanage-app-worker&sfp_email=&sfph_mail=

Product

https://plugins.trac.wordpress.org/browser/wemanage-app-worker/trunk/includes/class-nouvello-wemanage-worker-api-wc-ext-controller-functions.php#L982

Product

https://plugins.trac.wordpress.org/browser/wemanage-app-worker/trunk/includes/class-nouvello-wemanage-worker-api-wc-ext-controller.php#L166

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/a4219c10-9d2a-429d-9ac7-61efc02bd4cf?source=cve

Scores

CVSS v3 8.8

EPSS 0.0520

EPSS Percentile 90.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (2)

israelb1/Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring < 1.2.2

wemanage/wemanage < 1.2.3

Published Mar 20, 2024

Tracked Since Feb 18, 2026