CVE-2024-12854
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Jan 8, 2025
CWE ID 434
Summary
CVE-2024-12854 is a vulnerability affecting the Garden Gnome Package plugin for WordPress. This issue arises due to the plugin's failure to validate file types during the automatic extraction of 'ggpkg' files. Consequently, authenticated attackers with Author-level access or higher can exploit this vulnerability to upload arbitrary files on the affected site's server. Successful exploitation may lead to remote code execution. Versions up to and including 2.3.0 are susceptible to this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.