CVE-2024-10098

ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain

Affected

ApplyOnline

CVSS v3.1 CNA

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2025-05-15

Updated

2025-05-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/242dac1f-9a1f-4fde-b8c7-374bd451071d/

Security advisories

• https://wpscan.com/vulnerability/242dac1f-9a1f-4fde-b8c7-374bd451071d

References

• CVE Record
• NVD entry