CVE-2024-10629: 
WordPress vulnerability analysis and mitigation

The GPX Viewer plugin for WordPress contains a vulnerability (CVE-2024-10629) related to arbitrary file creation, discovered in versions up to and including 2.2.8. The vulnerability stems from a missing capability check and file type validation in the gpxvfileupload() function. This security issue was publicly disclosed on November 12, 2024 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The security flaw is classified as CWE-862 (Missing Authorization). The issue specifically resides in the gpxvfileupload() function where both capability checks and file type validation are absent (Wordfence).

The vulnerability allows authenticated attackers with subscriber-level access or higher to create arbitrary files on the affected site's server. This capability could potentially lead to remote code execution, significantly compromising the security of the affected WordPress installation (NVD).

Website administrators running the GPX Viewer plugin should immediately update to version 2.2.9 or later, which contains fixes for this vulnerability (NVD).