CVE-2024-3412Active Exploitation

LOWCVSS 9.1 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The WP STAGING WordPress Backup Plugin – Migration Backup Restore plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wpstg_processing AJAX action in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-434

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Referenced assets1 URL

By indicator

http://darknetmonitor.org

Full discourse1 post

Shadowcat Labs@shadowcatLabs151d
Active Exploitation
#EVEREST extortion group hit 16+ orgs incl. Gemini, NutraBio, HBX Group & PT Brantas Abipraya. Exploiting CVE-2025-0193 & CVE-2024-3412 w/ Cobalt Strike C2. Data releases if demands unmet. #ThreatIntel #CTI #Ransomware Seen at 👉http://darknetmonitor.org
Post summary
The post reports that the EVEREST extortion group has actively exploited CVE-2025-0193 and CVE-2024-3412 against over 16 organizations, using Cobalt Strike for command and control and threatening data release if demands are unmet.
000101.0K
9 followersView on X

Explore more

Back to dashboard