CVE-2024-9047
Published: 12 October 2024
Summary
CVE-2024-9047 is a critical-severity Path Traversal (CWE-22) vulnerability in Iptanus Wordpress File Upload. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The WordPress File Upload plugin for WordPress is vulnerable to path traversal in all versions through 4.24.11. The flaw exists in wfu_file_downloader.php and allows unauthenticated attackers to read or delete arbitrary files outside the intended directory when the site runs on PHP 7.4 or earlier. The issue is tracked as CWE-22 and carries a CVSS 3.1 score of 9.8.
Unauthenticated remote attackers can exploit the vulnerability over the network without any user interaction or credentials. Successful exploitation grants full read and delete access to files on the underlying server, potentially exposing sensitive configuration data, credentials, or other site content and enabling further compromise of the WordPress installation.
The referenced Wordfence advisory and the official plugin changeset on WordPress Trac indicate that the vendor has released a fix in version 4.24.12. Site administrators are advised to update the plugin immediately to close the path-traversal vector.
The EPSS score for this CVE currently stands at 0.9362 with a recorded peak of 0.9394, indicating sustained high exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49689
Vulnerability details
The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory.…
more
Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.