CVE-2024-10801Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. User registration must be enabled for this to be exploited.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://zerodaysignal.com/vulnerability/CVE-2024-10801

Full discourse1 post

0day Signal@0dayPublishing186d
Disclosure
🚨 CVE-2024-10801: WordPress User Extra Fields <= 1... Unauthenticated file upload with zero validation = instant webshell deployment on 16.5k+ WordPress installs running Use... https://zerodaysignal.com/vulnerability/CVE-2024-10801 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE‑2024‑10801, highlighting that the WordPress User Extra Fields plugin permits unauthenticated file uploads, enabling webshell deployment on over 16,000 installations, and provides a link to further details.
0000043
204 followersView on X

Explore more

Back to dashboard