CVE-2024-52375CWE-434

WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerability

Critical · published November 14, 2024

CVSS v3.1
10.0
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

🔥 An unrestricted file upload vulnerability in Datasets Manager by Arttia Creative is your new digital alarm bell! 🚨 Think of this like a restaurant that allows anyone to drop off food without checking for safety—an invitation for all sorts of dangerous items to enter the kitchen! An attacker could easily upload malicious files, potentially leading to remote code execution! That means they could take control of the server, steal sensitive data, or even launch attacks from your infrastructure—absolutely devastating!

Put simply

Think of this like a restaurant that allows anyone to drop off food without checking for safety—an invitation for all sorts of dangerous items to enter the kitchen! This vulnerability allows attackers to upload files of any type without proper checks, meaning they can submit harmful scripts or executables that the server will execute.

What to do

An attacker could easily upload malicious files, potentially leading to remote code execution! That means they could take control of the server, steal sensitive data, or even launch attacks from your infrastructure—absolutely devastating! Immediately patch to version 1.5.1 or higher to close this gap! Also, implement robust file type validation and a file upload whitelist to enhance security. Don't wait—act fast! You've got this! With these steps, you'll reinforce your defenses and soar to security hero status! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01389 · 72.1th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-11-14T18:09Z
EPSS history
Timeline
  • 14 NOV 18:09Z
    WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerability
    cvelistv5