CVE-2024-10938

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-506

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-109394.8The Image Widget WordPress plugin before 4.4.11 does not sanitise and escape some of its Image Widget settings, which could allow high privi CVE-2024-10947.3The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to un CVE-2024-109405.3A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrar CVE-2024-109416.5A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability aff CVE-2024-109427.5The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89 CVE-2024-109439.1An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and co CVE-2024-109448.4A Remote Code Execution vulnerability exists in the affected product. The vulnerability requires a high level of permissions and exists due CVE-2024-109457.3A Local Privilege Escalation vulnerability exists in the affected product. The vulnerability requires a local, low privileged threat actor t CVE-2024-109467.2A vulnerability classified as critical has been found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automatio CVE-2024-109477.2A vulnerability classified as critical was found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Man CVE-2024-109486.5A vulnerability in the upload function of binary-husky/gpt_academic allows any user to read arbitrary files on the system, including sensiti CVE-2024-10955.3The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a mi