# CVE-2024-9047: WordPress File Upload - Path Traversal

> Live exploitation tracking for CVE-2024-9047 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-9047

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Nickboss WordPress File Upload
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** cms, wordpress

## Description

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. This makes it possible for unauthenticated attackers to read or delete files outside of the originally intended directory. Successful exploitation requires the targeted WordPress installation to be using PHP 7.4 or earlier.

## CrowdSec analysis

[CVE-2024-9047](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-9047) is a path traversal vulnerability in the WordPress File Upload plugin up to version 4.24.11, allowing unauthenticated attackers to read or delete files outside the intended directory via the wfu_file_downloader.php script. Exploitation of this flaw could lead to unauthorized access or deletion of sensitive files on WordPress sites running PHP 7.4 or earlier, potentially resulting in data breaches or service disruption.

CrowdSec has been tracking this vulnerability and its exploits since 5th of March 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-9047 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the WordPress File Upload plugin by sending crafted requests to `/wp-content/plugins/wp-file-upload/wfu_file_downloader.php` with specific parameters, enabling arbitrary file read via path traversal.

## Timeline

- 2024-10-12: CVE Published. CVE-2024-9047 is published to NVD.
- 2025-03-05: Rule Released. CrowdSec releases a rule to detect CVE-2024-9047 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9047.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-9047) follows observed exploitation activity for CVE-2024-9047. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.