7.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
7.4 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.0%
WordPress is an open publishing platform for the Web. It’s possible for a
file of a type other than a zip file to be submitted as a new plugin by an
administrative user on the Plugins -> Add New -> Upload Plugin screen in
WordPress. If FTP credentials are requested for installation (in order to
move the file into place outside of the uploads
directory) then the
uploaded file remains temporary available in the Media Library despite it
not being allowed. If the DISALLOW_FILE_EDIT
constant is set to true
on
the site and FTP credentials are required when uploading a new theme or
plugin, then this technically allows an RCE when the user would otherwise
have no means of executing arbitrary PHP code. This issue only affects
Administrator level users on single site installations, and Super Admin
level users on Multisite installations where it’s otherwise expected that
the user does not have permission to upload or execute arbitrary PHP code.
Lower level users are not affected. Sites where the DISALLOW_FILE_MODS
constant is set to true
are not affected. Sites where an administrative
user either does not need to enter FTP credentials or they have access to
the valid FTP credentials, are not affected. The issue was fixed in
WordPress 6.4.3 on January 30, 2024 and backported to versions 6.3.3,
6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17,
5.2.20, 5.1.18, 5.0.21, 4.9.25, 2.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32,
4.3.33, 4.2.37, and 4.1.40. A workaround is available. If the
DISALLOW_FILE_MODS
constant is defined as true
then it will not be
possible for any user to upload a plugin and therefore this issue will not
be exploitable.
github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r
launchpad.net/bugs/cve/CVE-2024-31210
nvd.nist.gov/vuln/detail/CVE-2024-31210
security-tracker.debian.org/tracker/CVE-2024-31210
wordpress.org/news/2024/01/wordpress-6-4-3-maintenance-and-security-release/
www.cve.org/CVERecord?id=CVE-2024-31210
7.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
7.4 High
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.0%