CVE-2024-33556 HIGH

CVE-2024-33556: WordPress XStore Core plugin <= 5.3.8 - Limited Arbitrary File Upload vulnerability

Vendor 8Theme

Product XStore Core

Weakness CWE-434 · Unrestricted file upload

Published May 17, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

8.2/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.

Explanation of Vulnerability in Simple Terms

02Summary

XStore Core versions up to 5.3.8 do not properly validate file uploads, allowing an attacker to upload malicious files without authentication. This can lead to site disruption or data corruption. The vulnerability requires no user interaction and can be exploited remotely over the network.

What an attacker can do

03Attacker Capabilities

Upload malicious files to the site without authentication, disrupting service or corrupting data.

Potential impact on your site

04Site Impact

Attackers can upload files that disrupt your site's availability or corrupt stored data without needing a user account.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 17, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-33556 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html AskarLabs — CWE-434 write-up Unrestricted Upload of File with Dangerous Type

Related vulnerabilities