CVE-2024-52490 CRITICAL

CVE-2024-52490: WordPress Pathomation plugin <= 2.5.1 - Arbitrary File Upload vulnerability

Vendor Pathomation

Product Pathomation

Weakness CWE-434 · Unrestricted file upload

Published November 28, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in pathomation Pathomation pathomation allows Upload a Web Shell to a Web Server.This issue affects Pathomation: from n/a through <= 2.5.1.

Explanation of Vulnerability in Simple Terms

02Summary

Pathomation versions up to 2.5.1 allow unauthenticated attackers to upload files without restriction. An attacker can upload malicious files over the network with no authentication or user interaction required. This can lead to remote code execution, data theft, or site takeover depending on where uploaded files are stored and executed.

What an attacker can do

03Attacker Capabilities

Upload arbitrary files to the server without authentication, potentially leading to code execution or data compromise.

Potential impact on your site

04Site Impact

An attacker can upload and execute malicious code on your site, steal data, or take full control without needing a user account.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

November 28, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-52490 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html AskarLabs — CWE-434 write-up Unrestricted Upload of File with Dangerous Type

Related vulnerabilities