CVE-2024-11635
Published: 08 January 2025
Summary
CVE-2024-11635 is a critical-severity Code Injection (CWE-94) vulnerability in Iptanus Wordpress File Upload. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely patching of known flaws in vulnerable software components like the WordPress File Upload plugin versions up to 4.24.12 to prevent RCE exploitation.
Mandates validation of untrusted inputs such as the 'wfu_ABSPATH' cookie parameter to block code injection (CWE-94) in the plugin.
Enables vulnerability scanning to identify and prioritize the CVE-2024-11635 flaw in installed WordPress plugins before exploitation.
NVD Description
The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.24.12 via the 'wfu_ABSPATH' cookie parameter. This makes it possible for unauthenticated attackers to execute code on the server.
Deeper analysisAI
CVE-2024-11635, published on 2025-01-08, is a critical Remote Code Execution vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) classified under CWE-94 (Code Injection) in the WordPress File Upload plugin for WordPress. It affects all versions up to and including 4.24.12 and is exploitable via manipulation of the 'wfu_ABSPATH' cookie parameter, enabling arbitrary code execution on the server.
Unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction. Successful exploitation provides high impacts on confidentiality, integrity, and availability, allowing full control over the affected server.
Advisories and analyses, including Wordfence threat intelligence at https://www.wordfence.com/threat-intel/vulnerabilities/id/b5165f60-6515-4a2c-a124-cc88155eaf01?source=cve and a detailed breakdown at https://abrahack.com/posts/wp-file-upload-rce-part1/, provide further context. The plugin's source code, such as wfu_file_downloader.php at https://plugins.svn.wordpress.org/wp-file-upload/trunk/wfu_file_downloader.php, is referenced for review.
Details
- CWE(s)