CVE-2024-13471

DesignThemes Core Features <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file

CVSS 7.5 HIGHEPSS 0.5%CWE-22

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

05 mar 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dt_process_imported_file function in all versions up to, and including, 4.7. This makes it possible for unauthenticated attackers to read arbitrary files on the underlying operating system.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

designthemes · DesignThemes Core Features

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://themeforest.net/item/lms-learning-management-system-education-lms-wordpress-theme/7867581 https://www.wordfence.com/threat-intel/vulnerabilities/id/1729d0de-1f5f-4349-b592-5841d01ed33a?source=cve