CVE-2024-5677

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The Featured Image Generator plugin for WordPress is vulnerable to unauthorized image upload due to a missing capability check on the fig_save_after_generate_image function in all versions up to, and including, 1.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary images to a post-related gallery.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-567705.5In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In geneCVE-2024-567715.5In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information CVE-2024-567727.8In the Linux kernel, the following vulnerability has been resolved: kunit: string-stream: Fix a UAF bug in kunit_init_suite() In kunit_debCVE-2024-567735.5In the Linux kernel, the following vulnerability has been resolved: kunit: Fix potential null dereference in kunit_device_driver_test() kuCVE-2024-567745.5In the Linux kernel, the following vulnerability has been resolved: btrfs: add a sanity check for btrfs root in btrfs_search_slot() SyzbotCVE-2024-567757.8In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix handling of plane refcount [Why] The mechanism toCVE-2024-567765.5In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers The return valuCVE-2024-567775.5In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_gdp_atomiCVE-2024-567785.5In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atoCVE-2024-567795.5In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The actCVE-2024-56784.7Zohocorp ManageEngine Applications Manager versions 170900 and below are vulnerable to the authenticated admin-only SQL Injection in the CreCVE-2024-567805.5In the Linux kernel, the following vulnerability has been resolved: quota: flush quota_release_work upon quota writeback One of the paths