CVE-2024-9047 is a critical Path Traversal vulnerability affecting all versions up to and including 4.24.11 of the WordPress File Upload plugin. This flaw allows unauthenticated attackers to read or delete arbitrary files outside the intended directory, provided the WordPress installation uses PHP 7.4 or earlier. With a CVSS score of 9.8 (CRITICAL) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While not yet listed in CISA's KEV catalog, Nuclei templates exist for arbitrary file read, and there is community discussion and media coverage, including a report linking it to the "Earth Lamia" hacking group.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.24.12CPE matchmatch criteria | cpe:2.3:a:iptanus:wordpress_file_upload:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.