Redux Framework, CVE-2024-6828

CVE, Research URL: CVE-2024-6828
Home page URL: Security reports for Redux Framework
Application: Redux Framework
Published on: Jul 23, 2024
Research Description: The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Color_Scheme_Import function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated attackers to upload JSON files, which can be used to conduct stored cross-site scripting attacks and, in some rare cases, when the wp_filesystem fails to initialize - to Remote Code Execution.
Affected versions: Min -, max 4.4.18.
Status: vulnerable