Analysis Summary

CVE-2024-56049 CVSS:6.4

WPLMS plugin for WordPress could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences to delete arbitrary files on the system.

CVE-2024-52485 CVSS:6.5

Missing Authorization vulnerability in Yudiz Solutions Ltd. WP Menu Image allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Menu Image: from n/a through 2.2.

CVE-2024-55997 CVSS:6.5

Missing Authorization vulnerability in Web Chunky Order Delivery & Pickup Location Date Time allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery & Pickup Location Date Time: from n/a through 1.1.0.

Impact

• Gain Access

Indicators of Compromise

CVE

• CVE-2024-56049
• CVE-2024-52485
• CVE-2024-55997

Affected Vendors

Remediation

Upgrade to the latest version of Plugins, available from WordPress Plugin Directory.

CVE-2024-56049

CVE-2024-52485

CVE-2024-55997