What’s Vulnerable › Vulnerabilities

CVE-2024-9047: WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 93.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-10-12 · updated 2026-06-17
• Weakness: CWE-22

Description

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.

Affected products

• nickboss Iptanus File Upload: before 4.24.12 — fixed in 4.24.12

How to fix

Upgrade to a fixed version: nickboss Iptanus File Upload 4.24.12. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/3164449/wp-file-upload
• https://www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40f?source=cve

Get alerted when CVE-2024-9047 or the next vulnerability affects your stack