Lucene search
HistoryJul 29, 2024 - 6:15 a.m.
CVE-2024-6366
wordpress plugin
unauthorized access
media upload
CVSS3
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
0.001
Percentile
21.8%
The User Profile Builder WordPress plugin before 3.11.8 does not have proper authorisation, allowing unauthenticated users to upload media files via the async upload functionality of WP.
Related
cvelist
cvelist
CVE-2024-6366 User Profile Builder < 3.11.8 - Unauthenticated Media Upload
2024-07-29 06:00:08
vulnrichment
vulnrichment
CVE-2024-6366 User Profile Builder < 3.11.8 - Unauthenticated Media Upload
2024-07-29 06:00:08
githubexploit
githubexploit
Exploit for CVE-2024-6366
2024-08-03 10:30:49
nuclei
nuclei
User Profile Builder < 3.11.8 - File Upload
2024-07-29 17:07:32
cve
cve
CVE-2024-6366
2024-07-29 06:15:02
wordfence
wordfence
CVSS3
9.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
0.001
Percentile
21.8%
Related for NVD:CVE-2024-6366