CVE-2024-10586: 
WordPress vulnerability analysis and mitigation

The Debug Tool plugin for WordPress (versions up to 2.2) contains a critical vulnerability identified as CVE-2024-10586. The vulnerability stems from a missing capability check on the dbt_pull_image() function and missing file type validation, which was discovered and reported on November 8, 2024. This security flaw affects all versions of the Debug Tool plugin up to and including version 2.2 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The security issue is classified under CWE-862 (Missing Authorization). The vulnerability exists in the dbt_pull_image() function, which lacks proper capability checks and file type validation mechanisms (Wordfence).

The vulnerability allows unauthenticated attackers to create arbitrary files, including PHP files, on the affected system. This capability can be leveraged for remote code execution, potentially giving attackers complete control over the affected WordPress installation (NVD).

The vulnerability is particularly severe as it requires no authentication (unauthenticated) and can be exploited remotely. The attack complexity is rated as low, requiring no user interaction for successful exploitation (Wordfence).