CVE-2024-13365

Published Feb 12, 2025

Last updated 2 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2024-13365 is an arbitrary file upload vulnerability found in the WordPress plugin "Security & Malware scan by CleanTalk," affecting versions 2.149 and earlier. This flaw allows unauthenticated users to upload files of their choosing to vulnerable WordPress sites. The vulnerability exists due to insufficient validation of user-supplied data when the plugin scans ZIP archives. Exploiting this flaw could allow attackers to upload malicious files, potentially leading to remote code execution on the affected server. The issue was discovered by Wordfence through their bug bounty program and responsibly disclosed to CleanTalk. CleanTalk has since released version 2.150 of the plugin to address this vulnerability.

Description: The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to arbitrary file uploads due to the plugin uploading and extracting .zip archives when scanning them for malware through the checkUploadedArchive() function in all versions up to, and including, 2.149. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Source: security@wordfence.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security@wordfence.com: CWE-434

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cleantalk:security_\\&_malware_scan:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2FF0D925-2651-4B4C-8462-654680B73B3D",
            "versionEndExcluding": "2.150"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]