{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awebfulcreationscomputer_repair_shopwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:webfulcreations:computer_repair_shop:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2024-51793"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Computer Repair Shop (\u003c= 3.8115)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Webfulcreations"],"content_html":"\u003cp\u003eCVE-2024-51793 is an unauthenticated arbitrary file upload vulnerability in the Webfulcreations Computer Repair Shop WordPress plugin (versions 3.8115 and below). The flaw resides in the handling of requests to \u003ccode\u003eadmin-ajax.php\u003c/code\u003e, which can be leveraged to upload arbitrary PHP files without authentication. Once uploaded, these files can be executed, leading to full system compromise. Proof-of-concept exploit code is publicly available.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target running a vulnerable version of the Computer Repair Shop plugin.\u003c/li\u003e\n\u003cli\u003eAttacker sends an unauthenticated POST request to the \u003ccode\u003eadmin-ajax.php\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe request exploits the vulnerability to bypass file type validation.\u003c/li\u003e\n\u003cli\u003eA malicious PHP payload is uploaded to the web server directory.\u003c/li\u003e\n\u003cli\u003eThe server response provides the direct URL to the newly uploaded file.\u003c/li\u003e\n\u003cli\u003eAttacker accesses the PHP file via a browser to execute code and obtain an interactive shell.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for unauthenticated remote code execution with the privileges of the web server process. This results in complete compromise of confidentiality, integrity, and availability (CVSS 10.0).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Webfulcreations Computer Repair Shop to a version beyond 3.8115 immediately.\u003c/li\u003e\n\u003cli\u003eImplement monitoring for unexpected file creation within the WordPress \u003ccode\u003ewp-content/uploads\u003c/code\u003e directory or other web-accessible paths.\u003c/li\u003e\n\u003cli\u003eInspect web server access logs for anomalous POST requests directed at \u003ccode\u003eadmin-ajax.php\u003c/code\u003e containing file upload parameters.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, restrict access to \u003ccode\u003eadmin-ajax.php\u003c/code\u003e for unauthorized users via firewall or web application firewall (WAF) rules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T04:29:55Z","date_published":"2026-10-30T04:29:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-webfulcreations-rce/","summary":"CVE-2024-51793 is a critical unauthenticated arbitrary file upload vulnerability in the Webfulcreations Computer Repair Shop WordPress plugin, allowing attackers to achieve remote code execution via the admin-ajax.php endpoint.","title":"Webfulcreations Computer Repair Shop: Unauthenticated remote code execution (CVE-2024-51793)","url":"https://feed.craftedsignal.io/briefs/2026-10-webfulcreations-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:webfulcreations:computer_repair_shop:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}