Vendor
An unauthenticated remote code execution vulnerability (CVE-2024-9047) in the WordPress File Upload plugin version 4.24.11 and below allows path traversal and arbitrary file manipulation via the wfu_file_downloader.php script.