Vulnerability Details CVE-2024-7620
The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.021
EPSS Ranking 83.5%
CVSS Severity
CVSS v3 Score 6.6
References
Products affected by CVE-2024-7620
-
cpe:2.3:a:fastlinemedia:customizer_export/import:-
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.1
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.2
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.3
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.4
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.5
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.6
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.7
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.8
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.9
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.9.1
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.9.4
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.9.5
-
cpe:2.3:a:fastlinemedia:customizer_export/import:0.9.6