CVE-2024-50482
Published: 29 October 2024
Summary
CVE-2024-50482 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 1.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an unrestricted upload of a file with a dangerous type, tracked as CWE-434, in the Woocommerce Product Design plugin by Chetan Khandla. It affects WordPress installations running versions from n/a through 1.0.0 and permits an attacker to upload a web shell directly to the server. The issue carries a CVSS 3.1 score of 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Unauthenticated remote attackers can exploit the flaw over the network without credentials or user interaction. Successful exploitation grants the ability to place and execute arbitrary code, resulting in complete compromise of the confidentiality, integrity, and availability of the affected system and potentially other resources within the same security scope.
The vulnerability is catalogued in the Patchstack database, which provides the primary public reference for the issue at the listed URL. No additional advisory text or explicit patch instructions appear in the supplied references.
The EPSS score stands at 0.5550 for both current and peak values, indicating substantial exploitation interest without a documented rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44908
Vulnerability details
Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.