WooCommerce Upload Files Plugin up to 59.3 on WordPress Blacklist wcuf_file_name unrestricted upload

Summaryinfo

A vulnerability was found in WooCommerce Upload Files Plugin up to 59.3 on WordPress. It has been rated as critical. The affected element is an unknown function of the component Blacklist Handler. Performing a manipulation of the argument wcuf_file_name results in unrestricted upload. This vulnerability is identified as CVE-2021-24171. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in WooCommerce Upload Files Plugin up to 59.3 on WordPress (E-Commerce Management Software). This affects an unknown function of the component Blacklist Handler. The manipulation of the argument wcuf_file_name with an unknown input leads to a unrestricted upload vulnerability. CWE is classifying the issue as CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was released 04/06/2021. It is possible to read the advisory at wordfence.com. This vulnerability is uniquely identified as CVE-2021-24171. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

Upgrading to version 59.4 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Name

• WooCommerce Upload Files Plugin

Version

• 59.0
• 59.1
• 59.2
• 59.3

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion