CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-2381 – AliExpress Dropshipping with AliNext Lite <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2024-2381
18 Jun 2024 — The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajax_save_image function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. El complemento AliExpress Dropshipping con AliNext Lite para WordPress es vulnerable a la carga d... • https://plugins.trac.wordpress.org/browser/ali2woo-lite/trunk//includes/classes/controller/WooCommerceProductEditController.php#L108 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-4450 – AliExpress Dropshipping with AliNext Lite <= 3.3.5 - Missing Authorization via Several Functions
https://notcve.org/view.php?id=CVE-2024-4450
18 Jun 2024 — The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions like importing and modifying products. El complemento AliExpress Dropshipping con AliNext Lite para WordPress es vulnerable al acceso no autorizado debi... • https://plugins.trac.wordpress.org/browser/ali2woo-lite/trunk/includes/classes/controller/ImportAjaxController.php • CWE-862: Missing Authorization •