CVE-2024-31114
Published: 31 March 2024
Summary
CVE-2024-31114 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-31114 is an unrestricted upload of a file with dangerous type vulnerability, tracked as CWE-434, that affects the Shortcode Addons WordPress plugin maintained by biplob018. The flaw is present in all versions through 3.2.5 and carries a CVSS 3.1 score of 9.1.
An authenticated user with high privileges can upload arbitrary files to the affected site. Successful exploitation allows the attacker to achieve full control over the confidentiality, integrity, and availability of the WordPress installation and potentially the underlying host because the vulnerability has changed scope.
Public advisories published by Patchstack document the issue as an arbitrary file upload vulnerability and provide the canonical reference for the affected plugin versions.
The EPSS score reached 0.4866 at disclosure and has remained at that level, indicating sustained exploitation interest without a subsequent rise.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-29025
Vulnerability details
Unrestricted Upload of File with Dangerous Type vulnerability in biplob018 Shortcode Addons.This issue affects Shortcode Addons: from n/a through 3.2.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.