CVE-2024-53822CWE-434

WordPress Pie Register Premium plugin < 3.8.3.3 - Arbitrary File Upload vulnerability

Critical · published December 9, 2024

CVSS v3.1
10.0
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

🚨 A dangerous flaw lets attackers upload malicious files in Pie Register Premium, and it’s absolutely critical to fix! 🔥 Think of it like a restaurant allowing anyone to drop off their own cooking without checking it first — the result could be a kitchen disaster if someone brings in spoiled ingredients. 🚫🍴 If exploited, this vulnerability could allow an attacker to upload harmful files, potentially leading to server compromise, data theft, or even full control over the platform. Imagine a hacker walking through the back door of your server, ready to wreak havoc!

Put simply

Think of it like a restaurant allowing anyone to drop off their own cooking without checking it first — the result could be a kitchen disaster if someone brings in spoiled ingredients. 🚫🍴 This unrestricted file upload vulnerability permits the upload of dangerous file types without proper validation, specifically affecting versions prior to 3.8.3.3 of Pie Register Premium.

What to do

If exploited, this vulnerability could allow an attacker to upload harmful files, potentially leading to server compromise, data theft, or even full control over the platform. Imagine a hacker walking through the back door of your server, ready to wreak havoc! To secure your application, immediately update Pie Register Premium to version 3.8.3.3 or later. Additionally, implement strict file type validation to prevent uploads of any unauthorized file formats. 🛠️ You’ve got this! Fix it now and keep your server safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00772 · 55.2th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-12-09T12:24Z
EPSS history
Timeline
  • 09 DEC 12:24Z
    WordPress Pie Register Premium plugin < 3.8.3.3 - Arbitrary File Upload vulnerability
    cvelistv5