CVE-2024-9659

Summary

CVE-2024-9659 is a vulnerability affecting the School Management System plugin for WordPress. This issue, present in all versions up to 91.5.0, allows unauthenticated attackers to upload arbitrary files due to a missing file type validation in the mj_smgt_user_avatar_image_upload() function. Successful exploitation of this vulnerability may enable remote code execution, posing a significant security risk to WordPress sites using this plugin. It is highly recommended that users upgrade to the latest version as soon as possible to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.