CVE-2024-6885
Published: 23 July 2024
Summary
CVE-2024-6885 is a high-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 7.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The MaxiBlocks plugin for WordPress, versions up to and including 1.9.2, contains an arbitrary file deletion vulnerability (CWE-22) caused by insufficient file path validation in the maxi_remove_custom_image_size and maxi_add_custom_image_size functions. The flaw received a CVSS 3.1 score of 8.1 and affects the core class-maxi-image-crop.php component within the plugin.
Authenticated attackers with Subscriber-level access or higher can exploit the issue over the network without user interaction to delete arbitrary files on the server. Successful exploitation can readily result in remote code execution, for example by removing wp-config.php or other critical files.
The Wordfence advisory and WordPress plugin trac references identify the vulnerable code paths and confirm the issue is resolved by updating beyond version 1.9.2. EPSS for the CVE rose from lower values to a peak of 0.1084 on 2025-12-11 before receding to the current 0.0787, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47875
Vulnerability details
The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maxi_remove_custom_image_size and maxi_add_custom_image_size functions in all versions up to, and including, 1.9.2.…
more
This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.