CVE-2024-8671 is a critical arbitrary file overwrite vulnerability affecting the WooEvents - Calendar and Event Booking plugin for WordPress, impacting all versions up to 4.1.2. This flaw, due to insufficient file path validation, allows unauthenticated attackers to overwrite arbitrary files on the server. With a CVSS score of 9.1 (CRITICAL), the vulnerability has a network attack vector, low complexity, and can lead to remote code execution and complete system compromise. While there is no evidence of active exploitation or public exploit code in Metasploit or ExploitDB, the vulnerability has garnered significant community discussion, indicating potential interest from threat actors.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.1.3CPE matchmatch criteria | cpe:2.3:a:exthemes:wooevents:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.