CVE-2024-13011: critical vulnerability in Chimpstudio WP Foodbakery
WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload
Published · Updated
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.9%
exploitation probability
0.9%top 42% of all CVEs
observed exploitation
nono source reports it
The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Chimpstudio · WP FoodbakeryRelated CVEs — Chimpstudio WP Foodbakery
In the same product, most dangerous first.
CVE-2021-24389—FoodBakery < 2.2 - Reflected Cross-Site Scripting (XSS)EPSS 3.8%CVE-2026-15802HIGHWP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX ActionEPSS 0.8%CVE-2025-0181CRITICALWP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_requestEPSS 0.6%CVE-2025-0180CRITICALWP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validationEPSS 0.5%CVE-2024-13010MEDIUMWP Foodbakery <= 4.8 - Reflected Cross-Site ScriptingEPSS 0.3%