CVE-2024-51789 CRITICAL

CVE-2024-51789: WordPress Image Classify plugin <= 1.0.0 - Arbitrary File Upload vulnerability

Vendor Ujw0L

Product Image Classify

Weakness CWE-434 · Unrestricted file upload

Published November 11, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in UjW0L Image Classify image-classify allows Upload a Web Shell to a Web Server.This issue affects Image Classify: from n/a through <= 1.0.0.

Explanation of Vulnerability in Simple Terms

02Summary

Image Classify versions 1.0.0 and earlier contain an unrestricted file upload vulnerability. An attacker can upload arbitrary files to the server without authentication or user interaction. This allows execution of malicious code, data theft, and service disruption. All users should update immediately.

What an attacker can do

03Attacker Capabilities

Upload and execute arbitrary files on the server without authentication.

Potential impact on your site

04Site Impact

Complete compromise of the server: attackers can run code, steal data, modify content, and take the site offline.

Conditions required to exploit

05Prerequisites

Network access to the vulnerable application; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 11, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-51789 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html AskarLabs — CWE-434 write-up Unrestricted Upload of File with Dangerous Type

Related vulnerabilities