CVE-2024-8743
Published: 05 October 2024
Summary
CVE-2024-8743 is a medium-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Wordpress (inferred from references). Its CVSS base score is 6.8 (Medium).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Bit File Manager plugin for WordPress, a file manager and code editor component, is affected by CVE-2024-8743 in all versions through 6.5.7. The flaw is an insufficient file-type validation check that permits upload of .css and .js files, enabling stored cross-site scripting when those files are later served to other users.
Authenticated attackers holding Subscriber-level access (or higher) can exploit the issue once an administrator has granted the necessary file-manager permissions. Successful exploitation allows the attacker to store malicious JavaScript or CSS that executes in the context of other authenticated users, potentially leading to account takeover or administrative actions within the WordPress site.
The referenced Wordfence advisory and WordPress plugin changeset indicate that the vulnerability is addressed by an updated version of the plugin that enforces stricter file-type restrictions. Site administrators are advised to apply the available patch promptly.
The EPSS score has remained flat at its peak value of 0.4293 with no material upward trajectory observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49390
Vulnerability details
The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a…
more
lack of proper checks on allowed file types. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files, which could lead to Stored Cross-Site Scripting.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.