CVE-2024-13544 Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload
Administrators can upload arbitrary files to the server, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-13544?
CVE-2024-13544 is a medium-severity vulnerability in Unknown Zarinpal Paid Download, published on 11 Feb 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Weakness: CWE-434
Which versions are affected by CVE-2024-13544?
It affects 1 product.
Products include Amini7 Zarinpal Paid Download.
How do I fix CVE-2024-13544?
No fix has been published for CVE-2024-13544 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-13544 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-13544 exists.
Other vulnerabilities in Unknown Zarinpal Paid Download
Sources
Also known as GHSA-9m2c-327v-gghq.