CVE-2024-2381

CVE-2024-2381 is a critical arbitrary file upload vulnerability affecting all versions up to 3.3.5 of the AliExpress Dropshipping with AliNext Lite plugin for WordPress. The flaw stems from missing file type validation in the ajax_save_image function, allowing authenticated attackers with subscriber-level access or higher to upload malicious files. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk of remote code execution, complete compromise of confidentiality, integrity, and availability, and can be exploited with low complexity over the network. While the EPSS score suggests a relatively low probability of exploitation compared to other CVEs, there is currently no public exploit code available, nor is there evidence of active exploitation or significant community discussion.