CVE-2024-9756

🗓️ 12 Oct 2024 06:51:09Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 49 Views🌐 WEB

The WooCommerce plugin for WordPress (versions 2.0 to 2.4.1) allows unauthorized limited arbitrary file uploads, posing a security risk for authenticated attackers

Reporter	Title	Published	Views	Family All 13
GithubExploit	Exploit for Missing Authorization in Directsoftware Order_Attachments_For_Woocommerce	11 Mar 202502:04	–	githubexploit
Circl	CVE-2024-9756	12 Oct 202410:18	–	circl
CNNVD	WordPress plugin Order Attachments for WooCommerce 安全漏洞	12 Oct 202400:00	–	cnnvd
Cvelist	CVE-2024-9756 Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload	12 Oct 202406:51	–	cvelist
EUVD	EUVD-2024-50102	3 Oct 202520:07	–	euvd
NVD	CVE-2024-9756	12 Oct 202407:15	–	nvd
Packet Storm News	WordPress WooCommerce 2.4.1 Arbitrary File Upload	12 Mar 202500:00	–	packetstormnews
Patchstack	WordPress Order Attachments for WooCommerce plugin 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload vulnerability	14 Oct 202400:31	–	patchstack
Patchstack	WordPress Order Attachments for WooCommerce Plugin 2.0 - 2.4.1 is vulnerable to Broken Access Control	14 Oct 202400:00	–	patchstack
Positive Technologies	PT-2024-39820 · WordPress · Order Attachments For Woocommerce	12 Oct 202400:00	–	ptsecurity

NVD

Vulners

Node

directsoftware order_attachments_for_woocommerceRange2.0–2.5.0wordpress

[
  {
    "vendor": "sldesignpl",
    "product": "Order Attachments for WooCommerce",
    "versions": [
      {
        "version": "2.0",
        "status": "affected",
        "lessThanOrEqual": "2.4.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/order-attachments-for-woocommerce/tags/2.4.0/src/WCOA/Attachments/Attachment.php
plugins	www.plugins.trac.wordpress.org/browser/order-attachments-for-woocommerce/tags/2.4.0/src/WCOA/Utils/Ajax.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0dfc8957-78b8-4c55-ba95-52d95b086341
plugins	www.plugins.trac.wordpress.org/changeset

Parameter	Position	Path	Description	CWE
action	request body	/wp-admin/admin-ajax.php	Missing authorization on wcoa_add_attachment AJAX action allows authenticated users (Subscriber+) to upload restricted file types.	CWE-862

25 Nov 2024 20:49Current

4.9Medium risk

Vulners AI Score4.9

CVSS 3.14.3

EPSS0.04107

SSVC

CWE-862