CVE-2024-2381

HIGH

Ali2woo Aliexpress Dropshipping With ... - Unrestricted File Upload

Title source: rule

Description

The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save_image function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

References (3)

Core 3

Core References

https://plugins.trac.wordpress.org/changeset/3107543/ali2woo-lite/trunk/includes/classes/controller/WooCommerceProductEditController.php

Product

https://plugins.trac.wordpress.org/browser/ali2woo-lite/trunk//includes/classes/controller/WooCommerceProductEditController.php#L108

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/c3248327-6e10-420e-83cf-a23296eb2e6f?source=cve

Scores

CVSS v3 8.8

EPSS 0.0959

EPSS Percentile 92.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (2)

ali2woo/AliExpress Dropshipping Plugin for WooCommerce & WordPress < 3.3.5

ali2woo/aliexpress_dropshipping_with_alinext < 3.3.6

Published Jun 19, 2024

Tracked Since Feb 18, 2026