CVE-2024-53811 MEDIUM

CVE-2024-53811: WordPress WDesignKit plugin <= 1.0.40 - Arbitrary File Upload vulnerability

Vendor Posimyth

Product WDesignkit

Weakness CWE-434 · Unrestricted file upload

Published December 6, 2024

Last update May 12, 2026

View on NVD All CVEs

CVSS base score

6.6/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unrestricted Upload of File with Dangerous Type vulnerability in POSIMYTH WDesignkit wdesignkit allows Upload a Web Shell to a Web Server.This issue affects WDesignkit: from n/a through <= 1.0.40.

Explanation of Vulnerability in Simple Terms

02Summary

WDesignkit versions up to 1.0.40 allow authenticated administrators to upload files without proper validation. An attacker with admin privileges can upload malicious files that may affect the site's confidentiality, integrity, or availability. The vulnerability requires high-level access and does not require user interaction. Update to a version newer than 1.0.40.

What an attacker can do

03Attacker Capabilities

Upload files without validation to compromise site confidentiality, integrity, or availability.

Potential impact on your site

04Site Impact

A compromised admin account can upload malicious files affecting your site's security and operation.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the site.

Key dates

06Disclosure timeline

December 6, 2024 CVE published

May 12, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-53811 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/434.html AskarLabs — CWE-434 write-up Unrestricted Upload of File with Dangerous Type

Related vulnerabilities