CVE-2024-13448

CVE-2024-13448 is an arbitrary file upload vulnerability in the ThemeREX Addons plugin for WordPress, affecting all versions up to and including 2.32.3. The issue arises from missing file type validation in the 'trx_addons_uploads_save_data' function, classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for high-impact exploitation.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no privileges or user interaction required. By leveraging the flawed upload function, they can place arbitrary files on the affected WordPress site's server, which may enable remote code execution depending on the uploaded file type and server configuration.

Advisories provide further details on this vulnerability, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/7c1372bd-821d-439c-9b11-dfa5f08dd0dd?source=cve and the associated theme page on ThemeForest at https://themeforest.net/item/qwery-multipurpose-business-wordpress-theme/29678687. Security practitioners should consult these sources for recommended mitigations and patch information.