CVE-2024-5852

Name of the Vulnerable Software and Affected Versions: WordPress File Upload plugin for WordPress versions up to, and including, 4.24.7

Description: The issue allows authenticated attackers with Contributor-level access and above to upload limited files to arbitrary locations on the web server due to a Directory Traversal vulnerability. This is possible via the uploadpath parameter of the "wordpress file upload" shortcode.

Recommendations: For WordPress File Upload plugin for WordPress versions up to, and including, 4.24.7: Update to a version later than 4.24.7 to resolve the issue. As a temporary workaround, consider restricting access to the uploadpath parameter in the wordpress file upload shortcode to minimize the risk of exploitation.