WordPress core

CVE-2024-31210

PHP file upload bypass via Plugin installer

Severity: High 8.8
Published: 3 Apr 2024
Last changed: 17 Jun 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 5.9.9, 6.0.7, 6.1.5, 6.2.4, 6.3.3, 6.4.3
Also known as: GHSA-x79f-xrjv-jx5r
Sources: NVD, WordPress

Description

WordPress is an open publishing platform for the Web. It's possible for a file of a type other than a zip file to be submitted as a new plugin by an administrative user on the Plugins -> Add New -> Upload Plugin screen in WordPress. If FTP credentials are requested for installation (in order to move the file into place outside of the `uploads` directory) then the uploaded file remains temporary…

Affected software

Software Affected versions

Software	Affected versions
WordPressWordPress core · `cpe:a:wordpress:wordpress`	From 6.4.0 before 6.4.3 From 6.3 before 6.3.3 From 6.2 before 6.2.4 From 6.1 before 6.1.5 All 24 release lines Every version before 4.1.40 From 4.2 before 4.2.37 From 4.3 before 4.3.33 From 4.4 before 4.4.32 From 4.5 before 4.5.31 From 4.6 before 4.6.28 From 4.7 before 4.7.28 From 4.8 before 4.8.24 From 4.9 before 4.9.25 From 5.0 before 5.0.21 From 5.1 before 5.1.18 From 5.2 before 5.2.20 From 5.3 before 5.3.17 From 5.4 before 5.4.15 From 5.5 before 5.5.14 From 5.6 before 5.6.13 From 5.7 before 5.7.11 From 5.8 before 5.8.9 From 5.9 before 5.9.9 From 6.0 before 6.0.7 From 6.1 before 6.1.5 From 6.2 before 6.2.4 From 6.3 before 6.3.3 From 6.4.0 before 6.4.3

WordPressWordPress core · cpe:a:wordpress:wordpress

From 6.4.0 before 6.4.3
From 6.3 before 6.3.3
From 6.2 before 6.2.4
From 6.1 before 6.1.5

All 24 release lines

Every version before 4.1.40
From 4.2 before 4.2.37
From 4.3 before 4.3.33
From 4.4 before 4.4.32
From 4.5 before 4.5.31
From 4.6 before 4.6.28
From 4.7 before 4.7.28
From 4.8 before 4.8.24
From 4.9 before 4.9.25
From 5.0 before 5.0.21
From 5.1 before 5.1.18
From 5.2 before 5.2.20
From 5.3 before 5.3.17
From 5.4 before 5.4.15
From 5.5 before 5.5.14
From 5.6 before 5.6.13
From 5.7 before 5.7.11
From 5.8 before 5.8.9
From 5.9 before 5.9.9
From 6.0 before 6.0.7
From 6.1 before 6.1.5
From 6.2 before 6.2.4
From 6.3 before 6.3.3
From 6.4.0 before 6.4.3

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2024-31210
CVE.org https://www.cve.org/CVERecord?id=CVE-2024-31210
GitHub Advisory Database https://github.com/advisories/GHSA-x79f-xrjv-jx5r
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-x79f-xrjv-jx5r