CVE-2024-9939

HIGH

WordPress File Upload <= 4.24.13 - Unauthenticated Path Traversal to Arbitrary File Read in wfu_file_downloader.php

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-9939 has a selected CVSS score of 7.5 (high).

Description

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.13 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read files outside of the originally intended directory.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 8, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Iptanus File Upload

Browse nickboss / Iptanus File Upload

Default status: unaffected

CVE ListThrough 4.24.13affected

References

4