CVE-2024-9234

GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.

Affected

ataurr · GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor

CVSS v3.1 WORDFENCE

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

10.45% chance of exploitation in the next 30 days, 96th percentile

Nuclei

critical · CWE-862

Published

2024-10-11

Updated

2026-04-08

Proof-of-concept exploits (2)

• Nxploited/CVE-2024-92341★ · 2024-12-28
• RandomRobbieBF/CVE-2024-92342★ · 2024-10-17

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9234.yaml

References

• CVE Record
• NVD entry