CVE-2024-10960

Published Feb 12, 2025

Last updated 8 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-10960 is a vulnerability affecting the Brizy – Page Builder plugin for WordPress. Due to a lack of file type validation within the plugin's "storeUploads" function, authenticated users with contributor-level access or higher could upload arbitrary files to the server hosting the WordPress site. This vulnerability affects Brizy versions 2.6.4 and earlier. The potential outcome of a successful exploit could be remote code execution on the affected server.

Description: The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'storeUploads' function in all versions up to, and including, 2.6.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Source: security@wordfence.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security@wordfence.com: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:brizy:brizy:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "318CE83C-F93C-4B84-AACF-541CDB997487",
            "versionEndExcluding": "2.6.5"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]