CVE-2024-12853
Published: 08 January 2025
Summary
CVE-2024-12853 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wpchill Modula Image Gallery. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to and including 2.11.10. The issue is tracked as CWE-434 and carries a CVSS 3.1 score of 8.8, reflecting network-accessible exploitation with low attack complexity.
Authenticated users with Author-level privileges or higher can upload crafted zip archives that bypass intended restrictions, allowing arbitrary files to be placed on the server and potentially enabling remote code execution.
A fix is referenced in the WordPress plugin changeset that updates the affected versions, with additional analysis and detection guidance provided in the linked Wordfence threat intelligence entry.
The EPSS score reached a peak of 0.1927 after disclosure before settling at the current value of 0.1601, indicating emerging exploitation interest that warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51154
Vulnerability details
The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 2.11.10. This makes it possible for authenticated attackers, with…
more
Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unrestricted zip upload in public-facing WordPress plugin directly enables web shell deployment for RCE.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the arbitrary file upload flaw in the Modula plugin via patching to version beyond 2.11.10.
Mandates validation of file inputs including zip uploads to enforce expected file types and prevent arbitrary file uploads leading to RCE.
Deploys malicious code scanning on uploads to detect and block dangerous files like web shells extracted from malicious zips.