CVE-2024-12427CWE-862

Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload

Medium · published January 16, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00410 · 34.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-01-16T09:39Z
EPSS history
Timeline
  • 16 JAN 09:39Z
    Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload
    cvelistv5