CVE-2024-10547
CVSS 3.1 Score 9.8 of 10 (high)
Details
Published Nov 9, 2024
Updated: Nov 12, 2024
CWE ID 434
Summary
CVE-2024-10547 is a vulnerability affecting the WP Membership plugin for WordPress. This issue lies in the user_profile_image_upload() function, which fails to validate file types during upload in all versions up to 1.6.2. Consequently, unauthenticated attackers can exploit this weakness to upload arbitrary files, potentially leading to remote code execution and subsequent security breaches on impacted sites. This vulnerability underscores the importance of maintaining up-to-date software and implementing robust file upload validation measures.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.