CVE-2024-3277 MEDIUM

CVE-2024-3277: Yumpu ePaper publishing <= 2.0.24 - Missing Authorization to PDF Upload, Publishing, and API Key Modification

Vendor Yumpu

Product Yumpu E-Paper publishing

Weakness CWE-862 · Missing authorization

Published May 30, 2024

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

5.0/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

What the vulnerability does

01Description

The Yumpu ePaper publishing plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handler function in all versions up to, and including, 2.0.24. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload PDF files and publish them, as well as modify the API key.

Key dates

02Disclosure timeline

May 30, 2024 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-3277 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2024-11929 Responsive FlipBook Plugin Wordpress <= 2.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting CVE-2025-31386 WordPress Simple:Press plugin <= 6.11.5 - Broken Access Control vulnerability CVE-2025-49320 WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.11 - Broken Access Control Vulnerability CVE-2023-50876 WordPress Molongui plugin <= 4.7.3 - Broken Access Control vulnerability CVE-2024-38727 WordPress Seraphinite Post .DOCX Source plugin <= 2.16.9 - Broken Access Control vulnerability