CVE-2024-4345

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'process' function in the 'startklarDropZoneUploadProcess' class in versions up to, and including, 1.7.13. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
May 7, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-434507.5Windows DNS Spoofing VulnerabilityCVE-2024-434516.5NTLM Hash Disclosure Spoofing VulnerabilityCVE-2024-434527.5Windows Registry Elevation of Privilege VulnerabilityCVE-2024-434538.8Windows Routing and Remote Access Service (RRAS) Remote Code Execution VulnerabilityCVE-2024-434547.1Windows Remote Desktop Licensing Service Remote Code Execution VulnerabilityCVE-2024-434559.8Windows Remote Desktop Licensing Service Spoofing VulnerabilityCVE-2024-434567.4Windows Remote Desktop Services Tampering VulnerabilityCVE-2024-434577.8Windows Setup and Deployment Elevation of Privilege VulnerabilityCVE-2024-434587.7Windows Networking Information Disclosure VulnerabilityCVE-2024-434598.8SQL Server Native Client Remote Code Execution VulnerabilityCVE-2024-43469.1The Startklar Elementor Addons plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.7.13. TCVE-2024-434608.8Improper authorization in Dynamics 365 Business Central resulted in a vulnerability that allows an authenticated attacker to elevate privile
CVE-2024-4345: Critical severity, CVSS 9.8 | Vulnix