{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wordpress-file-upload--4.24.12/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:iptanus:wordpress_file_upload:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2024-9047"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Wordpress File Upload (\u003c 4.24.12)"],"_cs_severities":["critical"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Iptanus"],"content_html":"\u003cp\u003eCVE-2024-9047 is a critical security vulnerability affecting the Iptanus WordPress File Upload plugin in versions 4.24.11 and earlier. The vulnerability exists within the wfu_file_downloader.php file, which fails to properly sanitize user-supplied input. An unauthenticated attacker can leverage path traversal techniques to bypass security controls and perform arbitrary file access, manipulation, or modification on the host server. Given the availability of public proof-of-concept exploits and a high EPSS score of 93.3%, this vulnerability poses an immediate risk to WordPress instances running the affected software. Successful exploitation can lead to unauthenticated remote code execution, granting the attacker full control over the compromised web server and its hosted content.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker performs reconnaissance on a target WordPress site to confirm the presence of the 'wp-file-upload' plugin.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the vulnerable 'wfu_file_downloader.php' script located in '/wp-content/plugins/wp-file-upload/'.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP GET request targeting the 'wfu_file_downloader.php' script.\u003c/li\u003e\n\u003cli\u003eThe attacker injects path traversal payloads into the 'file' query parameter to escape the intended directory scope.\u003c/li\u003e\n\u003cli\u003eThe server processes the malicious input, allowing the attacker to access or include arbitrary files on the system.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the ability to include or manipulate files to execute arbitrary PHP code on the server.\u003c/li\u003e\n\u003cli\u003eUpon successful execution, the attacker gains a remote code execution context, allowing for further payload delivery or system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2024-9047 results in complete compromise of the WordPress site. Attackers can read sensitive configuration files, modify core site files, or inject webshells to maintain persistent access. With a CVSS score of 9.8, the potential for data exfiltration, service disruption, and unauthorized administrative control is severe.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the WordPress File Upload plugin to version 4.24.12 or later to mitigate CVE-2024-9047.\u003c/li\u003e\n\u003cli\u003eImplement the following web server log detection rule to identify exploitation attempts targeting the vulnerable file.\u003c/li\u003e\n\u003cli\u003eAudit access logs for anomalous HTTP GET requests involving the 'wfu_file_downloader.php' script containing path traversal characters like '../'.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-15T15:01:53Z","date_published":"2026-10-15T15:01:53Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-9047/","summary":"An unauthenticated remote code execution vulnerability (CVE-2024-9047) in the WordPress File Upload plugin version 4.24.11 and below allows path traversal and arbitrary file manipulation via the wfu_file_downloader.php script.","title":"Critical Unauthenticated RCE in WordPress File Upload Plugin (CVE-2024-9047)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-9047/"}],"language":"en","title":"CraftedSignal Threat Feed - Wordpress File Upload (\u003c 4.24.12)","version":"https://jsonfeed.org/version/1.1"}