CVE-2024-3112

Quotes and Tips < 1.45 - Admin+ Arbitrary File Upload

The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

Affected

Quotes and Tips by BestWebSoft

CVSS v3.1 NVD

4.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 CNA

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2024-07-12

Updated

2024-08-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/fa6f01d6-aa3b-4452-9c5f-49bb227fea9d/

Security advisories

• https://wpscan.com/vulnerability/fa6f01d6-aa3b-4452-9c5f-49bb227fea9d

References

• CVE Record
• NVD entry