Published On: Jan 31, 2025 17:05
Advisory No: TZCERT-SA-25-0056
Source: Wordfence
Software Affected: userpro-mediamanager, worpit-admin-dashboard-plugin, dc-woocommerce-multi-vendor, trx_addons
WordPress is vulnerable to a critical vulnerability. Exploitation of this vulnerability may allow an unauthenticated attacker to execute arbitrary code.
WordPress plugins userpro-mediamanager, worpit-admin-dashboard-plugin, dc-woocommerce-multi-vendor, and trx_addons are affected by the vulnerabilities tracked as CVE-2024-12822, CVE-2024-13742, CVE-2025-0493, and CVE-2024-13448 with a CVSS score of 9.8 each. The plugins are vulnerable due to missing capability check on the add_capto_img() function, presence of POP chain via an additional plugin or theme installed, Limited Local File Inclusion and missing file type validation in the 'trx_addons_uploads_save_data' function. The vulnerabilities allow unauthenticated attackers to gain administrative user access, bypass access controls, delete arbitrary files, retrieve sensitive data, or execute code.
Successful exploitation of these vulnerabilities may allow the attackers to gain escalated privileges on the affected system.
WordPress has released security patches for these vulnerabilities. Users and administrators are encouraged to apply necessary updates.
A digest of Tanzania Computer Emergency Response Team coverage of cyber-security news across the globe.
