CVE-2024-13544

Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload

The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

Affected

Zarinpal Paid Download

CVSS v3.1 NVD

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.33% chance of exploitation in the next 30 days, 25th percentile

Published

2025-02-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/91884263-62a7-436e-b19f-682b1aeb37d6/

Security advisories

• https://wpscan.com/vulnerability/91884263-62a7-436e-b19f-682b1aeb37d6

References

• CVE Record
• NVD entry