Lucene search

WordfenceCVE-2024-7484

HistoryAug 06, 2024 - 2:15 a.m.

CVE-2024-7484

2024-08-0602:15:35

CWE-434

Wordfence

web.nvd.nist.gov

wordpress

arbitrary file upload

remote code execution

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

24.0%

JSON

The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the ‘handle_uploaded_files’ function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site’s server which may make remote code execution possible.

Affected configurations

Vulners

Vulnrichment

Node

crmperkscrm_perks_formsRange≤1.1.3wordpress

VendorProductVersionCPE
crmperkscrm_perks_forms*cpe:2.3:a:crmperks:crm_perks_forms:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
crmperks	crm_perks_forms	*	cpe:2.3:a:crmperks:crm_perks_forms::::::wordpress::*

CNA Affected

[
  {
    "vendor": "crmperks",
    "product": "CRM Perks Forms – WordPress Form Builder",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.1.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/browser/crm-perks-forms/trunk/includes/front-form.php?rev=3003885#L3271

plugins.trac.wordpress.org/changeset/3016768/crm-perks-forms

www.wordfence.com/threat-intel/vulnerabilities/id/02c6ec97-50cc-4c61-9bb7-b94250d5dda3?source=cve

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

24.0%

JSON

Related for CVE-2024-7484