CVE-2024-35746: 
WordPress vulnerability analysis and mitigation

An Unrestricted Upload of File with Dangerous Type vulnerability has been identified in the BuddyPress Cover WordPress plugin, tracked as CVE-2024-35746. The vulnerability affects all versions of BuddyPress Cover up to and including version 2.1.4.2. This security flaw was discovered by YC_Infosec and was initially reported on May 14, 2024, with public disclosure occurring on June 6, 2024 (Patchstack).

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and has received a critical severity rating. It has been assigned a CVSS v3.1 base score of 10.0 (Critical) by Patchstack with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, while NIST assigned a score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability allows for arbitrary file upload capabilities that could lead to code injection (NVD).

The vulnerability allows malicious actors to upload any type of file to the affected website, including potential backdoors that can be executed to gain further access to the website. Given the critical CVSS score and the nature of the vulnerability, it is considered highly dangerous and is expected to become mass exploited (Patchstack).

The vulnerability requires no authentication to exploit, making it particularly dangerous. The attack vector is network-based, requires low attack complexity, and needs no user interaction for successful exploitation (Patchstack).

Currently, no official fix is available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement mitigation measures immediately (Patchstack).