CVE-2024-1538

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. This is due to missing or incorrect nonce validation on the wp_file_manager page that includes files through the 'lang' parameter. This makes it possible for unauthenticated attackers to include local JavaScript files that can be leveraged to achieve RCE via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This issue was partially patched in version 7.2.4, and fully patched in 7.2.5.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-15395.3An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, a CVE-2024-15408.2A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutral CVE-2024-15415.4The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htm CVE-2024-15435.5The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line re CVE-2024-15444.9Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the or CVE-2024-15458.8Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allow CVE-2024-15467.5When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memo CVE-2024-15476.5Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the vict CVE-2024-15484.3A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion an CVE-2024-15496.1If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in us CVE-2024-15506.1A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-pos CVE-2024-15516.1Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type respon