CVE-2024-10098 ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access
Unauthenticated attackers can access uploaded application files and private information due to missing authorization checks in the ApplyOnline plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10098?
CVE-2024-10098 is a low-severity missing authorization vulnerability in Unknown ApplyOnline, published on 15 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated users to access them and any private information they contain
Which versions are affected by CVE-2024-10098?
It affects 1 product.
Products include Spiderteams Applyonline - Application Form Builder and Manager.
How do I fix CVE-2024-10098?
No fix has been published for CVE-2024-10098 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-10098 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10098 exists.
Other vulnerabilities in Unknown ApplyOnline
Sources
Also known as GHSA-h58h-p5x5-v3wj.