- Description
- The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.
- Source
- security@wordfence.com
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- security@wordfence.com
- CWE-862
- Hype score
- Not currently trending
CVE-2024-9234: GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload. https://t.co/Uu2aofdDO9
@cyber_advising
29 Dec 2024
547 Impressions
0 Retweets
6 Likes
2 Bookmarks
0 Replies
0 Quotes
CVE-2024-9234 A nice vulnerability, the target directly downloads the remote compressed file, and the traffic does not pass through the cloud WAF (cloudflare crying).verify in /wp-content/plugins/poc.php. https://t.co/vR8Mb6w5Pk https://t.co/YUFpLcREan
@_r00tuser
21 Oct 2024
49 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes