CVE-2024-9047

The WordPress File Upload plugin by Iptanus contains an unauthenticated path traversal flaw (CWE-22) in its wfu_file_downloader.php script, affecting every plugin version up to and including 4.24.11. Because the vulnerable endpoint is reachable over the network without authentication or user interaction, a remote attacker can send crafted requests that traverse outside the originally intended directory. Successful exploitation lets the attacker read sensitive files outside the intended directory and delete arbitrary files, which can expose configuration secrets or disrupt the targeted site. Only WordPress sites running the affected plugin on PHP 7.4 or earlier are exploitable; installations hosted on newer PHP versions are not affected. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but an EPSS of 93.3% (100th percentile) indicates a very high likelihood of exploitation within the next 30 days.

What to do: Update WordPress File Upload to the latest release, i.e., any version newer than 4.24.11, as the primary fix. If an immediate update is not possible, upgrade the host to PHP 8.0 or later, which removes the exploitation condition, and review web logs for requests to wfu_file_downloader.php. Also check the server for unexpected file modifications or deletions.