CVE-2024-13011

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'upload_publisher_profile_image' function in versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Feb 10, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-130126.1A vulnerability, which was classified as problematic, has been found in code-projects Hostel Management System 1.0. This issue affects some CVE-2024-130136.1A vulnerability, which was classified as problematic, was found in PHPGurukul Maid Hiring Management System 1.0. Affected is an unknown funcCVE-2024-130149.8A vulnerability has been found in PHPGurukul Maid Hiring Management System 1.0 and classified as critical. Affected by this vulnerability isCVE-2024-130156.1A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0 and classified as problematic. Affected by this issue is some unknCVE-2024-130169.8A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0. It has been classified as critical. This affects an unknown part CVE-2024-130176.1A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0. It has been declared as problematic. This vulnerability affects uCVE-2024-130186.1A vulnerability was found in PHPGurukul Maid Hiring Management System 1.0. It has been rated as problematic. This issue affects some unknownCVE-2024-130194.6A vulnerability classified as problematic has been found in code-projects Chat System 1.0. Affected is an unknown function of the file /admiCVE-2024-13025.5Information exposure vulnerability in Badger Meter Monitool affecting versions up to 4.6.3 and earlier. A local attacker could change the apCVE-2024-130208.8A vulnerability classified as critical was found in code-projects Chat System 1.0. Affected by this vulnerability is an unknown functionalitCVE-2024-130215.4A vulnerability, which was classified as problematic, has been found in SourceCodester Road Accident Map Marker 1.0. Affected by this issue CVE-2024-130229.8A vulnerability, which was classified as critical, was found in taisan tarzan-cms 1.0.0. This affects the function UploadResponse of the fil