CVE-2024-10392
Published: 31 October 2024
Summary
CVE-2024-10392 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Other ATLAS/OWASP Terms risk domain.
Deeper analysis
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads because the handle_image_upload function lacks file type validation in all versions through 1.8.89. This flaw, assigned CWE-434, permits unauthenticated attackers to place arbitrary files on the server and potentially achieve remote code execution, reflected in the CVSS 9.8 score.
Unauthenticated attackers can exploit the issue over the network without user interaction by sending crafted requests that bypass the missing validation checks, resulting in full compromise of the confidentiality, integrity, and availability of the affected WordPress site.
The referenced WordPress plugin changeset and Wordfence advisory indicate that the issue was addressed by updating the plugin to a version beyond 1.8.89, with the fix committed to the repository to enforce proper file-type restrictions.
EPSS for this CVE rose materially from lower values to a peak of 0.5241 on 2025-12-11 before receding to the current 0.3591, indicating increased exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33082
Vulnerability details
The AI Power: Complete AI Pack plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'handle_image_upload' function in all versions up to, and including, 1.8.89. This makes it possible for unauthenticated attackers…
more
to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Other ATLAS/OWASP Terms
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- The vulnerability affects the 'AI Power: Complete AI Pack' WordPress plugin, which provides AI functionalities as an integrated pack for enterprise-like WordPress deployments, fitting the Enterprise AI Assistants category.
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated arbitrary file upload vulnerability in WordPress plugin enables exploitation of public-facing web application (T1190) and facilitates deployment of web shells for remote code execution and persistence (T1505.003).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.