Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

GPX Viewer plugin lets logged-in users create files on server

CVE-2024-10629 · published 1 year ago
Summary

The GPX Viewer add‑on for WordPress lets anyone with a basic account upload any kind of file to the website because it does not check who is uploading or what type of file it is. This could allow an attacker to place malicious files on the server, potentially leading to further compromise. Update the plugin to the latest version or remove it if you do not need the feature.

Original advisory text
The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and...
The GPX Viewer plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check and file type validation in the gpxv_file_upload() function in all versions up to, and including, 2.2.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary files on the affected site's server which may make remote code execution possible.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published13 Nov 2024
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-10629 · NVD
Track software like this
Free during beta