// For flags

CVE-2024-6885

MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles <= 1.9.2 - Authenticated (Subscriber+) Arbitrary File Deletion

Severity Score

8.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

The MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maxi_remove_custom_image_size and maxi_add_custom_image_size functions in all versions up to, and including, 1.9.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

El complemento MaxiBlocks: 2200+ Patterns, 190 Pages, 14.2K Icons &amp; 100 Styles para WordPress es vulnerable a la eliminación arbitraria de archivos debido a una validación insuficiente de la ruta del archivo en las funciones maxi_remove_custom_image_size y maxi_add_custom_image_size en todas las versiones hasta la 1.9.2 inclusive. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, eliminen archivos arbitrarios en el servidor, lo que puede conducir fácilmente a la ejecución remota de código cuando se elimina el archivo correcto (como wp-config.php).

*Credits: Lucio Sá
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-07-18 CVE Reserved
  • 2024-07-22 CVE Published
  • 2024-07-23 EPSS Updated
  • 2024-08-01 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ckp267
Search vendor "Ckp267"
 MaxiBlocks 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles
Search vendor "Ckp267" for product "MaxiBlocks 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles"
 <= 1.9.2
Search vendor "Ckp267" for product "MaxiBlocks 2200+ Patterns, 190 Pages, 14.2K Icons & 100 Styles" and version " <= 1.9.2"
en
Affected