CVE-2024-7863 Favicon Generator < 2.1 - Arbitrary File Upload via CSRF

2024-09-1306:00:04

WPScan

github.com

cve-2024-7863; favicon generator; arbitrary file upload; csrf; wordpress plugin; file validation; csrf checks; admin upload; php file

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

19.8%

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:pixeljar:favicon_generator:*:*:*:*:*:*:*:*"
    ],
    "vendor": "pixeljar",
    "product": "favicon_generator",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "2.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]