CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2024-9047Public Exploit

WordPress File Upload - Path Traversal (CVE-2024-9047)

PublishedOct 12, 2024
First SeenN/A
Last Seen
Reported
CVSS9.8
N
NickbossWordPress File Upload
cmswordpress

Description

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.

psychologyCrowdSec Analysis

CVE-2024-9047 is a path traversal vulnerability in the WordPress File Upload plugin up to version 4.24.11, allowing unauthenticated attackers to read or delete files outside the intended directory via the wfu_file_downloader.php script. Exploitation of this flaw could lead to unauthorized access or deletion of sensitive files on WordPress sites running PHP 7.4 or earlier, potentially resulting in data breaches or service disruption.

CrowdSec has been tracking this vulnerability and its exploits since 5th of March 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-9047 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the WordPress File Upload plugin by sending crafted requests to /wp-content/plugins/wp-file-upload/wfu_file_downloader.php with specific parameters, enabling arbitrary file read via path traversal.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2024-10-12
Rule Released2025-03-05

Related Weaknesses

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References