CVE-2024-51919

Critical

Published: 21 January 2025

Published

21 January 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0066 71.5th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-51919 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 28.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-51919 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in radykal's Fancy Product Designer WordPress plugin (fancy-product-designer). The issue affects all versions of the plugin from n/a through 6.4.3 inclusive. It carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to network accessibility, no required privileges or user interaction, high attack complexity, and significant impacts across confidentiality, integrity, availability, and scope change.

Unauthenticated attackers can exploit this vulnerability remotely by uploading arbitrary files with dangerous types, potentially leading to server compromise such as remote code execution or other malicious actions depending on the uploaded payload. The high attack complexity (AC:H) suggests exploitation requires specific conditions or techniques, but the lack of authentication barriers (PR:N) and changed scope (S:C) amplify the potential for widespread impact on affected WordPress sites.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/fancy-product-designer/vulnerability/wordpress-fancy-product-designer-plugin-6-4-3-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve provides details on this unauthenticated arbitrary file upload vulnerability in Fancy Product Designer version 6.4.3 and earlier, including recommended mitigations such as applying available patches or updates.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-45804

Vulnerability details

Unrestricted Upload of File with Dangerous Type vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer: from n/a through <= 6.4.3.

CWE(s): CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1505.003 Web Shell Persistence

Adversaries may backdoor web servers with web shells to establish persistent access to systems.

attack.mitre.org →

Why these techniques?

Unauthenticated arbitrary file upload in public-facing WordPress plugin directly enables T1190 (exploit of public app) and T1505.003 (web shell deployment for RCE).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1