How severe is CVE-2024-6828?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.2 out of 10.

What type of vulnerability is CVE-2024-6828?

This is classified as CWE-434, which is a common weakness in software security.

CVE-2024-6828 - HIGH Severity | CVSS 7.2

Vulnerability Description

The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Color_Scheme_Import function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated attackers to upload JSON files, which can be used to conduct stored cross-site scripting attacks and, in some rare cases, when the wp_filesystem fails to initialize - to Remote Code Execution.

Related Vulnerabilities

CVE-2011-2933

HIGH

CVSS:7.2(High)

An Arbitrary File Upload vulnerability exists in admin/media/upload.php in WebsiteBaker 2.8.1 and earlier due to a failure to restrict uploaded files with .htaccess, .php4, .php5, and .phtl extensions...

CWE-4342011

CVE-2014-9619

HIGH

CVSS:7.2(High)

Unrestricted file upload vulnerability in webadmin/ajaxfilemanager/ajaxfilemanager.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote authenticated users with ad...

CWE-4342014

CVE-2016-6104

HIGH

CVSS:7.2(High)

IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute a...

CWE-4342016

CVE-2016-9268

HIGH

CVSS:7.2(High)

Unrestricted file upload vulnerability in the Blog appearance in the "Install or upgrade manually" module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitra...

CWE-4342016

CVE-2017-1000119

HIGH

CVSS:7.2(High)

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.

CWE-4342017

CVE-2017-11154

HIGH

CVSS:7.2(High)

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter...

CWE-4342017