Medium severity4.3NVD Advisory· Published Jan 7, 2025· Updated Jun 17, 2026

CVE-2024-12719

Description

The WordPress File Upload plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wfu_ajax_action_read_subfolders' function in all versions up to, and including, 4.24.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform limited path traversal to view directories and subdirectories in WordPress. Files cannot be viewed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Iptanus/Wordpress File Upload
cpe:2.3:a:iptanus:wordpress_file_upload:*:*:*:*:*:wordpress:*:*
Range: <4.25.0
WordPress/Wordpress File Uploadllm-fuzzy2 versions
<=4.24.15+ 1 more
- (no CPE)range: <=4.24.15
- (no CPE)
nickboss/Iptanus File Uploadv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3217005/nvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/314ae0f5-8a4e-4bf3-9fc9-49f5b036b99envdThird Party Advisory
plugins.trac.wordpress.org/browser/wp-file-upload/trunk/lib/wfu_ajaxactions.phpnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000