CVE-2024-6366
CRITICAL NUCLEIUser Profile Builder <3.11.8 - Info Disclosure
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2024-6366. PoCs published by Boshe99, Nxploited, Abdurahmon3236. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains functional exploit code for CVE-2024-6366, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
Description
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
Exploits (3)
The repository contains functional exploit code for CVE-2024-6366, targeting a WordPress plugin (3DPrint Lite 1.9.1.4) with an arbitrary file upload vulnerability. The Python script demonstrates the ability to upload a malicious file to a vulnerable target.
This PoC demonstrates an unauthenticated media upload vulnerability in the User Profile Builder WordPress plugin before 3.11.8. It checks the plugin version and exploits the async upload functionality to upload a file without proper authorization.
This is a Metasploit module exploiting an unauthenticated file upload vulnerability in the WordPress User Profile Builder plugin before version 3.11.8, allowing remote code execution via malicious PHP payload upload.
Nuclei Templates (1)
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N