CVE-2024-10820

CVE-2024-10820 : The WooCommerce Upload Files plugin for WordPress (versions ≤ 84.3) is vulnerable to unauthenticated arbitrary file uploads due to missing file type validation in upload_files(). This could allow an attacker to upload arbitrary files to the server and may enable remote code execu...

CVE-2021-24171

Summary of CVE-2021-24171 (WooCommerce Upload Files, WordPress) : Versions prior to 59.4 allow unauthenticated arbitrary file upload due to a single sanitization pass that removes blocked extensions (e.g., .php). An attacker could bypass by embedding a blocked extension inside another blocked ext...