CVE-2024-10629: 
WordPress vulnerability analysis and mitigation

The GPX Viewer plugin for WordPress contains a vulnerability (CVE-2024-10629) related to arbitrary file creation, discovered in versions up to and including 2.2.8. The vulnerability stems from a missing capability check and file type validation in the gpxv_file_upload() function. This security issue was publicly disclosed on November 12, 2024 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The security flaw is classified as CWE-862 (Missing Authorization). The issue specifically resides in the gpxv_file_upload() function where both capability checks and file type validation are absent (Wordfence).

The vulnerability allows authenticated attackers with subscriber-level access or higher to create arbitrary files on the affected site's server. This capability could potentially lead to remote code execution, significantly compromising the security of the affected WordPress installation (NVD).

The vulnerability can be exploited by any authenticated user with subscriber-level privileges or higher. The attack requires low complexity and no user interaction, making it relatively straightforward to exploit (Wordfence).

Website administrators running the GPX Viewer plugin should immediately update to version 2.2.9 or later, which contains fixes for this vulnerability (NVD).