CVE-2024-7484 CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload

Q: What is CVE-2024-7484?

CVE-2024-7484 is a high-severity vulnerability in crmperks CRM Perks Forms – WordPress Form Builder, published on 6 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2024-7484 being exploited?

There is no known exploitation of CVE-2024-7484 in the wild and no public exploit code.

Q: How do I fix CVE-2024-7484?

No fix has been published for CVE-2024-7484 yet. Limit exposure of the affected software until one is available.

High 7.2 Published 6 Aug 2024 Updated 8 Apr 2026

Administrators can upload arbitrary files via insufficient validation, potentially leading to remote code execution on the server.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-7484?

CVE-2024-7484 is a high-severity vulnerability in crmperks CRM Perks Forms – WordPress Form Builder, published on 6 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded_files' function in versions up to, and including, 1.1.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Weakness: CWE-434

Which versions are affected by CVE-2024-7484?

It affects 1 product.

Products include Crmperks Crm Perks Forms.

How do I fix CVE-2024-7484?

No fix has been published for CVE-2024-7484 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-7484 being exploited?

There is no known exploitation of CVE-2024-7484 in the wild and no public exploit code.

Sources

Also known as GHSA-pw97-grw5-hp3h.