CVE-2024-7863
Favicon Generator < 2.1 - Arbitrary File Upload via CSRF
MEDIUM 6.8EPSS 0.3%
The Favicon Generator (CLOSED) WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server
- Affected
- Favicon Generator (CLOSED)
- CVSS v3.1 NVD
- 6.8 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - CVSS v3.1 CNA
- 8.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N - EPSS
- 0.29% chance of exploitation in the next 30 days, 20th percentile
- Published
- 2024-09-13