CVE-2024-13418highCWE-434

CVE-2024-13418: fallo de gravedad alta en G5Theme April Framework

Smart Framework <= Multiple Plugins - Authenticated (Subscriber+) Arbitrary File Upload

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear April Framework+ Monitorear Auteur Framework

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.8%
Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the date of this disclosure and the issue, while partially patched, is still vulnerable.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
G5Theme · April FrameworkG5Theme · Auteur FrameworkG5Theme · Benaa FrameworkG5Theme · Beyot Framework
CVEs relacionadas — G5Theme April Framework

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-13420MEDIUMSmart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Settings UpdatesEPSS 0.2%CVE-2024-13419MEDIUMSmart Framework <= Multiple Plugins - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%