CVE-2024-1169

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress is vulnerable to unauthorized media upload due to a missing capability check on the buddyforms_upload_handle_dropped_media function in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to upload media files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 7, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-116906.1The Financial Stocks & Crypto Market Data Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'e' parameter CVE-2024-116918.8Certain WebGL operations on Apple silicon M series devices could have lead to an out-of-bounds write and memory corruption due to a flaw in CVE-2024-116924.3An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks.CVE-2024-116939.8The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windows operating system CVE-2024-116946.1Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google Safe CVE-2024-116955.4A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spo CVE-2024-116965.4The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature verification. This flaw CVE-2024-116978.8When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?" confirmation dialog CVE-2024-116989.8A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen mode when a modal dial CVE-2024-116998.8Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption CVE-2024-11708.2The Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) plugin for WordPress CVE-2024-117008.1Malicious websites may have been able to perform user intent confirmation through tapjacking. This could have led to users unknowingly appro