CVE-2024-11615

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetra_deleteLanguageFile' and 'zetra_deleteFontsFile' functions. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes it possible for unauthenticated attackers to delete language files.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
May 5, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-116165.6Netskope was made aware of a security vulnerability in Netskope Endpoint DLP’s Content Control Driver where a double-fetch issue leads to heCVE-2024-116179.8The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'zetra_languageUpCVE-2024-116187.3A vulnerability classified as critical was found in IPC Unigy Management System 04.03.00.08.0027. Affected by this vulnerability is an unknoCVE-2024-116198.1A vulnerability, which was classified as problematic, has been found in macrozheng mall up to 1.0.3. Affected by this issue is some unknown CVE-2024-11624.3The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. TCVE-2024-116207.2Improper Control of Generation of Code ('Code Injection') vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Code InjectioCVE-2024-116218.8Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modifCVE-2024-116227.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certainCVE-2024-116234.8Authentik project is vulnerable to Stored XSS attacks through uploading crafted SVG files that are used as application icons.  This action cCVE-2024-116247.8there is a possible to add apps to bypass VPN due to Undeclared Permission . This could lead to local escalation of privilege with no additiCVE-2024-116255.3Information Exposure Through an Error Message vulnerability in Progress Software Corporation Sitefinity.This issue affects Sitefinity: from CVE-2024-116264.8Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerabilit