EUVD-2024-33082

🗓️ 31 Oct 2024 05:31:23Reported by EUVDType

AI Power plugin for WordPress allows file uploads without validation, risking remote code execution.

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	Vulnerability of the handle_imageUpload() function in the plugin for creating customizable content based on artificial intelligence (AI): The Complete AI Pack from the WordPress content management system allows attackers to execute arbitrary code.	7 Nov 202400:00	–	bdu_fstec
Circl	CVE-2024-10392	31 Oct 202407:45	–	circl
CNNVD	WordPress plugin AI Power: Complete AI Pack 代码问题漏洞	31 Oct 202400:00	–	cnnvd
CVE	CVE-2024-10392	31 Oct 202405:31	–	cve
Cvelist	CVE-2024-10392 AI Power: Complete AI Pack <= 1.8.89 - Unauthenticated Arbitrary File Upload	31 Oct 202405:31	–	cvelist
NVD	CVE-2024-10392	31 Oct 202406:15	–	nvd
Patchstack	WordPress AI Power: Complete AI Pack plugin <= 1.8.89 - Unauthenticated Arbitrary File Upload vulnerability	30 Oct 202420:28	–	patchstack
Patchstack	WordPress GPT3 AI Content Writer Plugin <= 1.8.89 is vulnerable to Arbitrary File Upload	30 Oct 202400:00	–	patchstack
Positive Technologies	PT-2024-7645 · WordPress · Ai Power: Complete Ai Pack	26 Oct 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-10392	5 Feb 202505:12	–	redhatcve

[
  {
    "enisaIdVendor": [
      {
        "id": "3fbe2533-bbed-30d0-8b8f-7f891b96c3ee",
        "vendor": {
          "name": "senols"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "9ace94ef-f69e-37b5-b111-8909d41672c7",
        "product": {
          "name": "AI Power: Complete AI Pack"
        },
        "product_version": "* ≤1.8.89"
      }
    ]
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/cd8a45c9-ca48-4ea6-b34e-f05206f16155
plugins	www.plugins.trac.wordpress.org/changeset/3176122/gpt3-ai-content-generator

31 Oct 2024 14:27Current

7.5High risk

Vulners AI Score7.5

CVSS 3.19.8

EPSS0.35907

SSVC