CVE-2024-10098

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain

CVSS v3.1

2.7 LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS

0.40% chance of exploitation in the next 30 days, 33th percentile

Published

2025-05-15

Updated

2025-05-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/242dac1f-9a1f-4fde-b8c7-374bd451071d/

References

• CVE Record
• NVD entry

Related

• CVE-2024-1009
• CVE-2024-1010
• CVE-2024-10081
• CVE-2024-10102
• CVE-2024-1008
• CVE-2024-10103