CVE-2024-6828CWE-434

Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting

High · published July 23, 2024

CVSS v3.1
7.2
EPSS
1%
Percentile
63.3
In the wild
Unconfirmed
What it is

The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Color_Scheme_Import function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated attackers to upload JSON files, which can be used to conduct stored cross-site scripting attacks and, in some rare cases, when the wp_filesystem fails to initialize - to Remote Code Execution.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01028 · 63.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2024-07-23T02:01Z
EPSS history
Timeline
  • 23 JUL 02:01Z
    Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting
    cvelistv5