Cyber Posture

CVE-2024-49249

High

Published: 07 January 2025

Published
07 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
EPSS Score 0.0030 52.9th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-49249 is a high-severity Path Traversal: '.../...//' (CWE-35) vulnerability. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents path traversal exploitation by validating inputs to block malicious sequences like '.../...//' before file operations.

SI-2 Flaw Remediation good match
prevent

Remediates the specific flaw in SMSA Shipping plugin versions <=2.3 by identifying, prioritizing, and applying patches for arbitrary file deletion.

AC-3 Access Enforcement partial match
prevent

Enforces logical access controls on files to limit unauthorized deletion even if traversal partially succeeds.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1485 Data Destruction Impact
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
attack.mitre.org →
Why these techniques?

Path traversal in public-facing WordPress plugin directly enables remote unauthenticated exploitation (T1190) and arbitrary file deletion for availability impact (T1485).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Path Traversal: '.../...//' vulnerability in SMSA Express SMSA Shipping smsa-shipping-official allows Path Traversal.This issue affects SMSA Shipping: from n/a through <= 2.3.

Deeper analysisAI

CVE-2024-49249 is a path traversal vulnerability in the SMSA Express SMSA Shipping Official WordPress plugin (smsa-shipping-official), affecting all versions up to and including 2.3. The issue, triggered by the '.../...//' traversal pattern, enables unauthorized file access and is rated with a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H), mapped to CWE-35.

Remote unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Exploitation allows arbitrary file deletion on the affected WordPress server, leading to significant availability impacts across the scoped components due to the changed scope (S:C).

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/smsa-shipping-official/vulnerability/wordpress-smsa-shipping-plugin-2-3-arbitrary-file-deletion-vulnerability?_s_id=cve characterizes this as an arbitrary file deletion vulnerability in SMSA Shipping plugin versions up to 2.3, providing details for security practitioners to assess and address the risk.

Details

CWE(s)
CWE-35

CVEs Like This One

CVE-2025-42937Shared CWE-35
CVE-2024-54362Shared CWE-35
CVE-2025-41723Shared CWE-35
CVE-2025-24685Shared CWE-35
CVE-2026-25397Shared CWE-35
CVE-2025-59793Shared CWE-35
CVE-2025-25122Shared CWE-35
CVE-2025-67914Shared CWE-35
CVE-2025-26354Shared CWE-35
CVE-2025-26356Shared CWE-35

References