CVE-2024-7384highCWE-434

CVE-2024-7384: fallo de gravedad alta en acyba AcyMailing – An Ultimate Newsletter…

AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.0%
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive function in all versions up to, and including, 9.7.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
acyba · AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
CVEs relacionadas — acyba AcyMailing – An Ultimate Newsletter…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-77807HIGHAcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' ParameterEPSS 0.9%CVE-2026-15426HIGHAcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template UpdateEPSS 0.7%CVE-2026-3614HIGHAcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationEPSS 0.4%CVE-2026-12170MEDIUMAcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' AttributeEPSS 0.3%CVE-2026-5200HIGHAcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'EPSS 0.3%CVE-2026-102562HIGHAcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' ParameterEPSS 0.2%