{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31210", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-29T14:16:31.900Z", "datePublished": "2024-04-04T22:59:28.955Z", "dateUpdated": "2024-08-02T01:46:04.580Z"}, "containers": {"cna": {"title": "PHP file upload bypass via Plugin installer", "problemTypes": [{"descriptions": [{"cweId": "CWE-434", "lang": "en", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r"}], "affected": [{"vendor": "WordPress", "product": "wordpress-develop", "versions": [{"version": ">= 6.4.0, < 6.4.3", "status": "affected"}, {"version": ">= 6.3.0, < 6.3.3", "status": "affected"}, {"version": ">= 6.2.0, < 6.2.4", "status": "affected"}, {"version": ">= 6.1.0, < 6.1.5", "status": "affected"}, {"version": ">= 6.0.0, < 6.0.7", "status": "affected"}, {"version": ">= 5.9.0, < 5.9.9", "status": "affected"}, {"version": ">= 5.8.0, < 5.8.9", "status": "affected"}, {"version": ">= 5.7.0, < 5.7.11", "status": "affected"}, {"version": ">= 5.6.0, < 5.6.13", "status": "affected"}, {"version": ">= 5.5.0, < 5.5.14", "status": "affected"}, {"version": ">= 5.4.0, < 5.4.15", "status": "affected"}, {"version": ">= 5.3.0, < 5.3.17", "status": "affected"}, {"version": ">= 5.2.0, < 5.2.20", "status": "affected"}, {"version": ">= 5.1.0, < 5.1.18", "status": "affected"}, {"version": ">= 5.0.0, < 5.0.21", "status": "affected"}, {"version": ">= 4.9.0, < 4.9.25", "status": "affected"}, {"version": ">= 4.8.0, < 4.8.24", "status": "affected"}, {"version": ">= 4.7.0, < 4.7.28", "status": "affected"}, {"version": ">= 4.6.0, < 4.6.28", "status": "affected"}, {"version": ">= 4.5.0, < 4.5.31", "status": "affected"}, {"version": ">= 4.4.0, < 4.4.32", "status": "affected"}, {"version": ">= 4.3.0, < 4.3.33", "status": "affected"}, {"version": ">= 4.2.0, < 4.2.37", "status": "affected"}, {"version": "< 4.1.40", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-04T22:59:28.955Z"}, "descriptions": [{"lang": "en", "value": "WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary available in the Media Library despite it not being allowed. If the `DISALLOW_FILE_EDIT` constant is set to `true` on the site _and_ FTP credentials are required when uploading a new theme or plugin, then this technically allows an RCE when the user would otherwise have no means of executing arbitrary PHP code. This issue _only_ affects Administrator level users on single site installations, and Super Admin level users on Multisite installations where it's otherwise expected that the user does not have permission to upload or execute arbitrary PHP code. Lower level users are not affected. Sites where the `DISALLOW_FILE_MODS` constant is set to `true` are not affected. Sites where an administrative user either does not need to enter FTP credentials or they have access to the valid FTP credentials, are not affected. The issue was fixed in WordPress 6.4.3 on January 30, 2024 and backported to versions 6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 2.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3.33, 4.2.37, and 4.1.40. A workaround is available. If the `DISALLOW_FILE_MODS` constant is defined as `true` then it will not be possible for any user to upload a plugin and therefore this issue will not be exploitable.\n"}], "source": {"advisory": "GHSA-x79f-xrjv-jx5r", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "wordpress", "product": "wordpress-develop", "cpes": ["cpe:2.3:a:wordpress:wordpress-develop:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "6.4.3", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-05T13:59:35.660459Z", "id": "CVE-2024-31210", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T19:47:42.302Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:46:04.580Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31210", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-05T13:59:35.660459Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wordpress:wordpress-develop:*:*:*:*:*:*:*:*"], "vendor": "wordpress", "product": "wordpress-develop", "versions": [{"status": "affected", "version": "0", "lessThan": "6.4.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T19:47:35.688Z"}}], "cna": {"title": "PHP file upload bypass via Plugin installer", "source": {"advisory": "GHSA-x79f-xrjv-jx5r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "WordPress", "product": "wordpress-develop", "versions": [{"status": "affected", "version": ">= 6.4.0, < 6.4.3"}, {"status": "affected", "version": ">= 6.3.0, < 6.3.3"}, {"status": "affected", "version": ">= 6.2.0, < 6.2.4"}, {"status": "affected", "version": ">= 6.1.0, < 6.1.5"}, {"status": "affected", "version": ">= 6.0.0, < 6.0.7"}, {"status": "affected", "version": ">= 5.9.0, < 5.9.9"}, {"status": "affected", "version": ">= 5.8.0, < 5.8.9"}, {"status": "affected", "version": ">= 5.7.0, < 5.7.11"}, {"status": "affected", "version": ">= 5.6.0, < 5.6.13"}, {"status": "affected", "version": ">= 5.5.0, < 5.5.14"}, {"status": "affected", "version": ">= 5.4.0, < 5.4.15"}, {"status": "affected", "version": ">= 5.3.0, < 5.3.17"}, {"status": "affected", "version": ">= 5.2.0, < 5.2.20"}, {"status": "affected", "version": ">= 5.1.0, < 5.1.18"}, {"status": "affected", "version": ">= 5.0.0, < 5.0.21"}, {"status": "affected", "version": ">= 4.9.0, < 4.9.25"}, {"status": "affected", "version": ">= 4.8.0, < 4.8.24"}, {"status": "affected", "version": ">= 4.7.0, < 4.7.28"}, {"status": "affected", "version": ">= 4.6.0, < 4.6.28"}, {"status": "affected", "version": ">= 4.5.0, < 4.5.31"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.32"}, {"status": "affected", "version": ">= 4.3.0, < 4.3.33"}, {"status": "affected", "version": ">= 4.2.0, < 4.2.37"}, {"status": "affected", "version": "< 4.1.40"}]}], "references": [{"url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r", "name": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary available in the Media Library despite it not being allowed. If the `DISALLOW_FILE_EDIT` constant is set to `true` on the site _and_ FTP credentials are required when uploading a new theme or plugin, then this technically allows an RCE when the user would otherwise have no means of executing arbitrary PHP code. This issue _only_ affects Administrator level users on single site installations, and Super Admin level users on Multisite installations where it's otherwise expected that the user does not have permission to upload or execute arbitrary PHP code. Lower level users are not affected. Sites where the `DISALLOW_FILE_MODS` constant is set to `true` are not affected. Sites where an administrative user either does not need to enter FTP credentials or they have access to the valid FTP credentials, are not affected. The issue was fixed in WordPress 6.4.3 on January 30, 2024 and backported to versions 6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 2.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3.33, 4.2.37, and 4.1.40. A workaround is available. If the `DISALLOW_FILE_MODS` constant is defined as `true` then it will not be possible for any user to upload a plugin and therefore this issue will not be exploitable.\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434: Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-04T22:59:28.955Z"}}}, "cveMetadata": {"cveId": "CVE-2024-31210", "state": "PUBLISHED", "dateUpdated": "2024-07-31T19:47:42.302Z", "dateReserved": "2024-03-29T14:16:31.900Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-04T22:59:28.955Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary available in the Media Library despite it not being allowed. If the `DISALLOW_FILE_EDIT` constant is set to `true` on the site _and_ FTP credentials are required when uploading a new theme or plugin, then this technically allows an RCE when the user would otherwise have no means of executing arbitrary PHP code. This issue _only_ affects Administrator level users on single site installations, and Super Admin level users on Multisite installations where it's otherwise expected that the user does not have permission to upload or execute arbitrary PHP code. Lower level users are not affected. Sites where the `DISALLOW_FILE_MODS` constant is set to `true` are not affected. Sites where an administrative user either does not need to enter FTP credentials or they have access to the valid FTP credentials, are not affected. The issue was fixed in WordPress 6.4.3 on January 30, 2024 and backported to versions 6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13, 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 2.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3.33, 4.2.37, and 4.1.40. A workaround is available. If the `DISALLOW_FILE_MODS` constant is defined as `true` then it will not be possible for any user to upload a plugin and therefore this issue will not be exploitable.\n"}, {"lang": "es", "value": "WordPress es una plataforma de publicaci\u00f3n abierta para la Web. Es posible que un usuario administrativo env\u00ede un archivo de un tipo que no sea un archivo zip como un nuevo complemento en la pantalla Complementos -&gt; Agregar nuevo -&gt; Cargar complemento en WordPress. Si se solicitan credenciales FTP para la instalaci\u00f3n (para mover el archivo a un lugar fuera del directorio `uploads`), entonces el archivo cargado permanece disponible temporalmente en la librer\u00eda multimedia a pesar de que no est\u00e9 permitido. Si la constante `DISALLOW_FILE_EDIT` se establece en `true` en el sitio _y_ se requieren credenciales FTP al cargar un nuevo tema o complemento, entonces esto t\u00e9cnicamente permite un RCE cuando el usuario no tendr\u00eda medios para ejecutar c\u00f3digo PHP arbitrario. Este problema _solo_ afecta a los usuarios de nivel de administrador en instalaciones de un solo sitio y a los usuarios de nivel de superadministrador en instalaciones de m\u00faltiples sitios donde, de lo contrario, se espera que el usuario no tenga permiso para cargar o ejecutar c\u00f3digo PHP arbitrario. Los usuarios de niveles inferiores no se ven afectados. Los sitios donde la constante `DISALLOW_FILE_MODS` est\u00e1 establecida en `true` no se ven afectados. Los sitios donde un usuario administrativo no necesita ingresar credenciales FTP o tiene acceso a las credenciales FTP v\u00e1lidas no se ven afectados. El problema se solucion\u00f3 en WordPress 6.4.3 el 30 de enero de 2024 y se actualiz\u00f3 a las versiones 6.3.3, 6.2.4, 6.1.5, 6.0.7, 5.9.9, 5.8.9, 5.7.11, 5.6.13. 5.5.14, 5.4.15, 5.3.17, 5.2.20, 5.1.18, 5.0.21, 4.9.25, 2.8.24, 4.7.28, 4.6.28, 4.5.31, 4.4.32, 4.3. 33, 4.2.37 y 4.1.40. Hay una soluci\u00f3n disponible. Si la constante `DISALLOW_FILE_MODS` se define como `true`, ning\u00fan usuario podr\u00e1 cargar un complemento y, por lo tanto, este problema no ser\u00e1 explotable."}], "id": "CVE-2024-31210", "lastModified": "2024-11-21T09:13:02.827", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-04-04T23:15:16.127", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}