Unrated severityNVD Advisory· Published Mar 8, 2025· Updated Apr 8, 2026
SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload
CVE-2024-13908
Description
The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: <=1.1.9
- bestweblayout/SMTP by BestWebSoftv5Range: 0
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.