CVE-2024-6651

MEDIUMNuclei

WordPress File Upload < 4.24.8 - Reflected XSS

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-6651 has a selected CVSS score of 6.1 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 6, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

WordPress File Upload

Default status: unaffected

CVE ListBefore 4.24.8affected

wordpress_file_upload

Browse wordpress_file_upload_project / wordpress_file_upload

Default status: unknown

CVE ListBefore 4.24.8affected

Proofs of concept

1

Repository PoCs

GitHubyup-Ivan/CVE-2024-6651Repository PoCby yup-Ivan1Writeup2 files

1.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README file describing CVE-2024-6651, a Reflected XSS vulnerability in the WordPress File Upload plugin. It provides a vulnerability description, prerequisites, and installation instructions, but does not include any exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing a proof-of-concept for CVE-2024-6651, a reflected XSS vulnerability in the WordPress File Upload plugin. The file contains no executable code, no obfuscated content, and no instructions for the reviewer to perform any action beyond reading the documentation. It describes the vulnerability, its target, and educational intent. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationWriteup
Model confidence95%
AuthenticationRequired
LanguagesSpanish
Target softwareWordPress File Upload plugin
Attack typesReflected XSS
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README file that provides a technical description of the CVE-2024-6651 vulnerability, including its type, affected component, and attack vector. It does not contain any executable code, scanner logic, or proof-of-concept exploit. The file references a 'payload.txt' but it is not included in the evidence packet.

README.md:1-37

Requirements

  • Vulnerable WordPress File Upload plugin version < 4.24.8README.md:28
  • A crafted XSS payloadREADME.md:29

Observed behavior

  • The README describes a Reflected XSS vulnerability in the WordPress File Upload plugin's admin panel via the 'dir' parameter in the File Browser functionality.README.md:11-14
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
Payload withheldThe README describes a standard proof-of-concept for a known CVE. It does not instruct the reviewer to execute any code or perform any action that would compromise their own system.README.md:1-15
Usage Disclaimer
Payload withheldThe file includes a standard educational-use disclaimer, which is common in PoC repositories and does not indicate malicious intent toward the reviewer.README.md:16
Review boundaries

What the analysis did not establish

  • The evidence packet contains only the README.md file; the referenced 'payload.txt' file is not included, so its contents cannot be analyzed.
  • The analysis is based solely on the description in the README; no source code or executable exploit is present.
  • The file 'payload.txt' is listed in the artifact inventory but its content is not included in the evidence packet. Its nature (e.g., a harmless XSS payload or something else) cannot be verified from the supplied evidence.
  • The review is based solely on the text of README.md; no other files or repository metadata were analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

1
ProjectDiscoveryHIGHWordPress File Upload Plugin < 4.24.8 - Cross-Site ScriptingCVSS 7.1

The WordPress File Upload plugin before version 4.24.8 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'dir' parameter in the file browser page before outputting it back, which could allow attackers to execute arbitrary JavaScript code in an administrator's browser context.

Impact

Attackers can execute arbitrary JavaScript in administrator browsers by crafting malicious URLs with XSS payloads in the dir parameter.

Remediation

Update WordPress File Upload plugin to version 4.24.8 or later to address the reflected XSS vulnerability.

WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2024wpwordpresswp-pluginxsswp-file-uploadauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
FOFA: body='wp-content/plugins/wp-file-upload/'
https://wpscan.com/vulnerability/65e2c77d-09bd-4a44-81d9-d7a5db0e0f84 https://nvd.nist.gov/vuln/detail/CVE-2024-6651

Source: ProjectDiscovery

References

2