CVE-2024-12042

Summary

CVE-2024-12042 is a Stored Cross-Site Scripting vulnerability affecting the MStore API plugin for WordPress, which allows users to create native Android and iOS apps on the cloud. The issue lies in the profile picture upload functionality, where insufficient file type validation is present. Malicious users with subscriber-level access or higher can exploit this vulnerability by uploading HTML files containing arbitrary web scripts. When a user accesses the infected file, the web scripts will execute, potentially leading to unintended actions or data theft. Unpatched installations of the plugin up to, and including, version 4.16.4 are at risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.