CVE-2024-25909CWE-434

WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload

Critical · published February 26, 2024

CVSS v3.1
9.9
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

🚨 An unrestricted file upload vulnerability is wide open for mischief in JoomUnited WP Media Folder! 🥴 Think of it like a restaurant that allows patrons to bring any dish into the kitchen without checking for allergens or health violations. That’s exactly what this flaw does: it lets anyone upload potentially harmful files without proper checks! An attacker could easily upload malicious files, leading to a full compromise of your website. This could mean anything from stealing sensitive data to deploying malware that wreaks havoc on your server. The potential fallout is absolutely devastating! 🔥

Put simply

Think of it like a restaurant that allows patrons to bring any dish into the kitchen without checking for allergens or health violations. That’s exactly what this flaw does: it lets anyone upload potentially harmful files without proper checks! This vulnerability allows users to upload files of dangerous types without validation, affecting versions up to 5.7.2. Simply put, it’s like having a door to your server that anyone can open to drop in harmful content.

What to do

An attacker could easily upload malicious files, leading to a full compromise of your website. This could mean anything from stealing sensitive data to deploying malware that wreaks havoc on your server. The potential fallout is absolutely devastating! 🔥 To protect yourself, immediately update the JoomUnited WP Media Folder plugin to version 5.7.3 or higher. Also, review your file upload settings to ensure only safe file types are allowed. 🚀 You've got this! Follow these steps, and you'll be securing your site in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00643 · 50.2th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-02-26T15:28Z
EPSS history
Timeline
  • 26 FEB 15:28Z
    WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload
    cvelistv5