CVE-2024-12427 Multi Step Form <= 1.7.23 - Missing Authorization to Unauthenticated Limited File Upload
Unauthenticated attackers can upload limited file types due to a missing capability check in the Multi Step Form WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-12427?
CVE-2024-12427 is a medium-severity missing authorization vulnerability in mondula2016 Multi Step Form, published on 16 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images.
Weakness: CWE-862
Which versions are affected by CVE-2024-12427?
It affects 1 product.
Products include Mondula Multi Step Form.
How do I fix CVE-2024-12427?
No fix has been published for CVE-2024-12427 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-12427 being exploited?
There is no known exploitation of CVE-2024-12427 in the wild and no public exploit code.
Other vulnerabilities in mondula2016 Multi Step Form
- CVE-2018-14430 Cross-site scripting in n/a
- CVE-2023-50832 WordPress Multi Step Form Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-25905 WordPress Multi Step Form Plugin <= 1.7.18 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2023-47758 WordPress Multi Step Form Plugin <= 1.7.11 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2018-14846 Cross-site scripting in n/a
Sources
Also known as GHSA-8979-rxc8-68vq.