VulnerabilityAnalyzed

CVE-2024-13418

Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions.

HIGH 8.8EPSS 0.71%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.71%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Multiple plugins and/or themes for WordPress are vulnerable to Arbitrary File Uploads due to a missing capability check on the ajaxUploadFonts() function in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files that can make remote code execution possible. This issue was escalated to Envato over two months from the date of this disclosure and the issue, while partially patched, is still vulnerable.

CVSS 3.1: 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.71% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-434
Affected: g5plus/april · g5plus/auteur · g5plus/benaa · g5plus/beyot
Source: security@wordfence.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.