CVE-2024-6318

moderate-risk
Published 2024-07-04

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'upload_img_file' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Do I need to act?

!
10.9% chance of exploitation in next 30 days
EPSS score — higher than 89% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Wbolt

References (6)

Product https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.cl...
Patch https://plugins.trac.wordpress.org/changeset/3107741/imgspider
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/306f00e4-9a70-48be-a91...
Product https://plugins.trac.wordpress.org/browser/imgspider/tags/2.3.10/classes/post.cl...
Patch https://plugins.trac.wordpress.org/changeset/3107741/imgspider
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/306f00e4-9a70-48be-a91...
46
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 11/34 · Low
Exposure 5/34 · Minimal