Back

CVE-2024-6828

July 23, 2024, 2:15 a.m.

Received
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Redux Framework plugin for WordPress

  • 4.4.12
  • 4.4.13
  • 4.4.14
  • 4.4.15
  • 4.4.16
  • 4.4.17

Source

security@wordfence.com

Tags

security@wordfence.com
CWE-434
2024-07-23
CVE-2024-6828

CVE-2024-6828 details

Published : July 23, 2024, 2:15 a.m.
Last Modified : July 23, 2024, 2:15 a.m.

Description

The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Color_Scheme_Import function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated attackers to upload JSON files, which can be used to conduct stored cross-site scripting attacks and, in some rare cases, when the wp_filesystem fails to initialize - to Remote Code Execution.

CVSS Score

1 2 3 4 5 6 7.2 8 9 10

Weakness

Weakness Name Description
CWE-434 Unrestricted Upload of File with Dangerous Type The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

Base Score

7.2

Exploitability Score

3.9

Impact Score

2.7

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

URL Source
https://core.trac.wordpress.org/browser/tags/6.5.4/src/wp-includes/class-wp-theme-json.php#L1690 security@wordfence.com
https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/classes/class-redux-filesystem.php#L614 security@wordfence.com
https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/classes/class-redux-helpers.php#L938 security@wordfence.com
https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/extensions/color_scheme/color_scheme/class-redux-color-scheme-import.php#L75 security@wordfence.com
https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/fields/typography/redux-typography.js#L646 security@wordfence.com
https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/classes/class-redux-filesystem.php#L166 security@wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/18a37063-31aa-4b1f-b1a5-1ea921a20686?source=cve security@wordfence.com
This website uses the NVD API, but is not approved or certified by it.