CVE-2024-50529CWE-434

WordPress Training – Courses plugin <= 2.0.1 - Arbitrary File Upload vulnerability

Critical · published November 4, 2024

CVSS v3.1
9.9
EPSS
0%
Percentile
41.3
In the wild
Unconfirmed
What it is

🚨 An unrestricted upload vulnerability lets anyone sneak in a web shell—like a delivery person dropping off a package without checking the contents! 🔥 Imagine a restaurant that allows any dish to be served in the kitchen without inspection. An unscrupulous chef could slip in a recipe that sabotages the entire meal, making every diner sick. This vulnerability could allow attackers to gain unauthorized access to your server, executing malicious commands and potentially taking full control. With a CVSS score of 9.9, the consequences are absolutely devastating—think data theft, service disruption, or worse!

Put simply

Imagine a restaurant that allows any dish to be served in the kitchen without inspection. An unscrupulous chef could slip in a recipe that sabotages the entire meal, making every diner sick. The unrestricted upload flaw in Rudrainn Training – Courses allows attackers to upload dangerous files, such as web shells, bypassing any security checks, and compromising web server integrity.

What to do

This vulnerability could allow attackers to gain unauthorized access to your server, executing malicious commands and potentially taking full control. With a CVSS score of 9.9, the consequences are absolutely devastating—think data theft, service disruption, or worse! To protect your system, immediately upgrade to version 2.0.2 or later, implement strict file type validation, and ensure that file uploads go through appropriate security measures like virus scanning. Don't delay your security checks! You've got this! By following these steps, you'll enhance your defenses and keep your system secure. 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00492 · 41.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-11-04T13:41Z
EPSS history
Timeline
  • 04 NOV 13:41Z
    WordPress Training – Courses plugin <= 2.0.1 - Arbitrary File Upload vulnerability
    cvelistv5