CVE-2024-9932

The Wux Blog Editor plugin for WordPress fails to adequately validate file types in its 'wuxbt_insertImageNew' function, allowing unauthenticated attackers to upload arbitrary files to the affected site's server. The flaw is triggered remotely over the network with no authentication and no user interaction, by sending a crafted upload request to the vulnerable function. Because attackers can place arbitrary files (potentially including executable PHP) on the server, successful exploitation may result in remote code execution and full site compromise. Any WordPress site running Wux Blog Editor version 3.0.0 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known as of this analysis, although EPSS assigns a 36.4% (98th percentile) probability of exploitation within the next 30 days.

What to do: Update Wux Blog Editor to the latest patched release (a version beyond 3.0.0) as soon as the vendor publishes one, or temporarily deactivate or remove the plugin if no fixed version is available. Administrators should inspect the uploads directory and web root for unexpected PHP or other executable files that could indicate prior compromise, and consider a WAF rule blocking unauthenticated requests to the vulnerable upload endpoint as an interim mitigation.