CVE-2024-3242highobserved exploitationCWE-434

CVE-2024-3242: high-severity vulnerability in themefusecom Brizy – Page Builder

Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor Brizy – Page Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 8.8epss 1.0%
from disclosure to weapon
Published on NVDJul 18
VulnCheck+817d
The Brizy – Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension validation in the validateImageContent function called via storeImages in all versions up to, and including, 2.4.43. This makes it possible for authenticated attackers, with contributor access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Version 2.4.44 prevents the upload of files ending in .sh and .php. Version 2.4.45 fully patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
themefusecom · Brizy – Page Builder
Related CVEs — themefusecom Brizy – Page Builder

In the same product, most dangerous first.

CVE-2024-1311HIGHBrizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File UploadEPSS 1.5%CVE-2024-10960CRITICALBrizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploadsEPSS 0.9%CVE-2024-1165MEDIUMBrizy – Page Builder <= 2.4.39 - Authenticated (Contributor+) Directory TraversalEPSS 0.8%CVE-2020-36714HIGHBrizy < 1.0.126 - Authorization Bypass to Settings UpdatesEPSS 0.5%CVE-2024-1296MEDIUMBrizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-5324HIGHBrizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field ValueEPSS 0.4%