CVE-2024-12881
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Dec 24, 2024
CWE ID 862
Summary
CVE-2024-12881 is a vulnerability affecting the PlugVersions plugin for WordPress. This issue allows authenticated attackers with Subscriber-level access and above to perform arbitrary file uploads. The vulnerability stems from a missing capability check on the eos_plugin_reviews_restore_version() function, which is present in all versions up to and including 0.0.7. By exploiting this flaw, attackers can create and leverage arbitrary files on the target system.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.