CVE-2024-8699

Published: May 15, 2025Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The Z-Downloads WordPress plugin before 1.11.5 does not properly validate files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)

Affected (1)

Products: Urbanbase: Z Downloads

Urbanbase

1 product

Z Downloads

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Urbanbase Z Downloads	Before 1.11.5

References (2)

https://wpscan.com/vulnerability/9013351e-224f-4696-970f-eb843dc8dace/

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/9013351e-224f-4696-970f-eb843dc8dace/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.