CVE-2024-7620 Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import
Administrators can upload arbitrary files via the import function, potentially leading to remote code execution if exploited with a race condition.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-7620?
CVE-2024-7620 is a medium-severity vulnerability in beaverbuilder Customizer Export/Import, published on 7 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.
Weakness: CWE-434
Which versions are affected by CVE-2024-7620?
It affects 1 product.
Products include Fastlinemedia Customizer Export\/Import.
How do I fix CVE-2024-7620?
No fix has been published for CVE-2024-7620 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-7620 being exploited?
There is no known exploitation of CVE-2024-7620 in the wild and no public exploit code.
Other vulnerabilities in beaverbuilder Customizer Export/Import
Sources
Also known as GHSA-3x6p-q4pv-82hr.