CVE-2024-9307

Summary

CVE-2024-9307: This vulnerability affects the mFolio Lite plugin for WordPress, which allows authenticated attackers with Author-level access or higher to upload arbitrary web scripts through a missing capability check. These scripts can execute when a user opens an SVG file, posing a threat for code injection. Additionally, attackers can upload EXE files, potentially leading to remote code execution if they gain server access or trick site visitors into downloading and running the malicious files.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.