sbomify Insights

Search by CVE or GitHub advisory id, package name or title.

CVE-2024-3962 Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file

Critical 9.8 Published Updated

Unauthenticated attackers can upload arbitrary files to achieve remote code execution if the PPOM Pro plugin and a specific product field are configured.

Exploited in the wild
Not known
Login needed
Not needed
Attackable
Over the internet
Victim action needed
Not needed
Fix
None listed

What is CVE-2024-3962?

CVE-2024-3962 is a critical vulnerability in themeisle PPOM – Product Addons & Custom Fields for WooCommerce, published on 26 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Product Addons & Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ppom_upload_file function in all versions up to, and including, 32.0.18. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Successful exploitation requires the PPOM Pro plugin to be installed along with a WooCommerce product that contains a file upload field to retrieve the correct nonce.

Weakness: CWE-434

Which versions are affected by CVE-2024-3962?

It affects 1 product.

Products include Themeisle Product Addons \& Fields for Woocommerce.

How do I fix CVE-2024-3962?

No fix has been published for CVE-2024-3962 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-3962 being exploited?

There is no known exploitation of CVE-2024-3962 in the wild and no public exploit code.

Sources

Also known as GHSA-3q47-w545-wgfv.

Is CVE-2024-3962 in your software?

Upload an SBOM and sbomify checks it against every vulnerability here, every day.

Check your SBOMs for free