CVE-2024-13361

Summary

CVE-2024-13361 is a vulnerability affecting the AI Power: Complete AI Pack plugin for WordPress. This issue permits authenticated attackers, including those with Subscriber-level access and above, to gain unauthorized access. The vulnerability arises due to a missing capability check on the wpaicg_save_image_media function in all versions up to and including 1.8.96. Malicious actors can exploit this flaw to upload image files and embed malicious shortcode attributes in the image_alt value. Upon sending a POST request to the attachment page, these attributes will execute, potentially leading to serious security consequences.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.