CVE-2024-6885

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maxi_remove_custom_image_size and maxi_add_custom_image_size functions in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
ckp267	MaxiBlocks Builder \| 17,000+ Design Assets, Patterns, Icons & Starter Sites	<= 1.9.2

References

Timeline

Published: Jul 23, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-688610.0Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea Open Source Git Ser CVE-2024-68874.8The Giveaways and Contests by RafflePress WordPress plugin before 1.12.16 does not sanitise and escape some of its Giveaways settings, whic CVE-2024-68884.8The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whic CVE-2024-68894.8The Secure Copy Content Protection and Content Locking WordPress plugin before 4.1.7 does not sanitise and escape some of its settings, whic CVE-2024-68908.8Password reset tokens are generated using an insecure source of randomness. Attackers who know the username of the Journyx installation user CVE-2024-68918.8Attackers with a valid username and password can exploit a python code injection vulnerability during the natural login flow.CVE-2024-68926.1Attackers can craft a malicious link that once clicked will execute arbitrary JavaScript in the context of the Journyx web application.CVE-2024-68937.5The "soap_cgi.pyc" API handler allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticat CVE-2024-68945.4The RD Station plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.3.2 due to insuffic CVE-2024-68956.1Insufficient authentication in user account management in Yugabyte Platform allows local network attackers with a compromised user session t CVE-2024-68965.4The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all vers CVE-2024-68976.4The aThemes Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and