Critical severity9.8NVD Advisory· Published Oct 12, 2024· Updated Jun 17, 2026

CVE-2024-9047

Description

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Wordpress File Uploadllm-fuzzy
Range: <=4.24.11
nickboss/Iptanus File Uploadv5
Range: 0

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changeset/3164449/wp-file-uploadnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/554a314c-9e8e-4691-9792-d086790ef40fnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.074
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000