CVE-2024-11613

WordPress File Upload <= 4.24.15 - Unauthenticated Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in all versions up to, and including, 4.24.15 via the 'wfu_file_downloader.php' file. This is due to lack of proper sanitization of the 'source' parameter and allowing a user-defined directory path. This makes it possible for unauthenticated attackers to execute code on the server.

Affected

nickboss · Iptanus File Upload

CVSS v3.1 WORDFENCE

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

4.44% chance of exploitation in the next 30 days, 91st percentile

Published

2025-01-08

Updated

2026-04-08

Proof-of-concept exploits (1)

• Sachinart/CVE-2024-11613-wp-file-upload4★ · 2025-01-08

Security advisories

• https://www.wordfence.com/threat-intel/vulnerabilities/id/31052fe6-a0ae-4502-b2d2-dbc3b3b…
• https://plugins.trac.wordpress.org/changeset/3217005
• https://plugins.svn.wordpress.org/wp-file-upload/trunk/wfu_file_downloader.php

References

• CVE Record
• NVD entry

Related

• CVE-2024-0012
• CVE-2024-38063
• CVE-2024-56145
• CVE-2024-9474
• CVE-2025-24752
• CVE-2025-32432