CVE-2024-10800

CVE-2024-10800 : WordPress User Extra Fields plugin (

CVE-2024-10800 WordPress User Extra Fields <= 16.6 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajaxsavefields function in all versions up to, and including, 16.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to ad...

CVE-2024-11150: Improper Limitation of a Pathname to a Restricted Directory

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletetmpuploadedfile function in all versions up to, and including, 16.6. This makes it possible for unauthenticated attackers to delete arbitrary files o...

WordPress User Extra Fields Plugin <= 16.6 is vulnerable to Arbitrary File Deletion

Software User Extra Fields Type Plugin Vulnerable versions = 16.6 Fixed in 16.7 OWASP Top 10 A2: Broken Authentication Classification Arbitrary File Deletion CVE CVE-2024-11150 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 5b9352f46ad9 Credits Chloe Chamberland Require...

PT-2024-16790 · WordPress · Wordpress User Extra Fields

Name of the Vulnerable Software and Affected Versions: WordPress User Extra Fields plugin versions up to, and including, 16.6 Description: The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete tmp...

WordPress User Extra Fields Plugin <= 16.6 is vulnerable to Privilege Escalation

Software User Extra Fields Type Plugin Vulnerable versions = 16.6 Fixed in 16.7 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2024-10800 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 90d7101cbd67 Credits Tonn Required privilege...

WordPress plugin User Extra Fields security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

WordPress plugin User Extra Fields: Path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exis...

CVE-2024-10800: Missing Authorization

The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajaxsavefields function in all versions up to, and including, 16.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to ad...

PT-2024-16559

Name of the Vulnerable Software and Affected Versions WordPress User Extra Fields plugin versions up to, and including, 16.6 Description The WordPress User Extra Fields plugin is vulnerable to privilege escalation due to a missing capability check on the ajax save fields function. This allows...

CVE-2024-10801

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxmanagefilechunkupload function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on...

CVE-2024-10801 WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxmanagefilechunkupload function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on...

CVE-2024-10801

CVE-2024-10801 affects the WordPress plugin User Extra Fields . The vulnerability stems from missing file type validation in the ajax_manage_file_chunk_upload() function across all versions up to 16.5. This allows unauthenticated attackers to upload arbitrary files to the affected site, with the ...

CVE-2024-10801 WordPress User Extra Fields <= 16.5 - Unauthenticated Arbitrary File Upload

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxmanagefilechunkupload function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on...

WordPress User Extra Fields plugin <= 16.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Tonn in WordPress Plugin User Extra Fields versions = 16.5...

WordPress User Extra Fields Plugin <= 16.5 is vulnerable to Arbitrary File Upload

Software User Extra Fields Type Plugin Vulnerable versions = 16.5 Fixed in 16.6 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2024-10801 Patch priority High CVSS severity High 10 Developer Claim ownership PSID f72c87b2aed7 Credits Tonn Required privilege Unauthenticated...

PT-2024-16560

Name of the Vulnerable Software and Affected Versions WordPress User Extra Fields plugin versions up to and including 16.5 Description The WordPress User Extra Fields plugin is vulnerable to arbitrary file uploads due to missing file type validation in the ajax manage file chunk upload function...

CVE-2024-10801: Unrestricted Upload of File with Dangerous Type

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxmanagefilechunkupload function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on...

WordPress plugin: WordPress User Extra Fields code issue vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

Heap-based Buffer Overflow

fiona is vulnerable to Heap-based Buffer Overflow. The vulnerability is due to improper handling of long filenames, comments, or extra fields in within zlib components that contain integer overflow vulnerabilities, which can result in an application crash or potential code execution...