CVE-2024-10801

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_manage_file_chunk_upload() function in all versions up to, and including, 16.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. User registration must be enabled for this to be exploited.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Nov 9, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-108025.3The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_g CVE-2024-108037.5The MP3 Sticky Player plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.0 via the content/do CVE-2024-108047.5The Ultimate Video Player WordPress & WooCommerce Plugin plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an CVE-2024-108058.8A vulnerability was found in code-projects University Event Management System 1.0. It has been classified as critical. This affects an unkno CVE-2024-108064.8A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been declared as problematic. This vulnerability affects unkn CVE-2024-108074.8A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been rated as problematic. This issue affects some unknown pr CVE-2024-108087.5A vulnerability has been found in code-projects E-Health Care System 1.0 and classified as critical. This vulnerability affects unknown code CVE-2024-108097.5A vulnerability was found in code-projects E-Health Care System 1.0 and classified as critical. This issue affects some unknown processing o CVE-2024-10815.4The 3D FlipBook – PDF Flipbook WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bookmark feature CVE-2024-108107.5A vulnerability was found in code-projects E-Health Care System 1.0. It has been classified as critical. Affected is an unknown function of CVE-2024-108117.5Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote CVE-2024-108126.1An open redirect vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs when a user is redirected to a URL