CVE-2024-0380
published 2024-02-05CVE-2024-0380: The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' attribute used in…
PriorityP422medium4.3CVSS 3.1
AVNACLPRLUINSUCLINAN
EPSS
0.81%
52.3th percentile
The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' attribute used in Shortcodes. This makes it possible for authenticated attackers, with contributor-level access and above, to include the contents of SVG files on the server, which can be leveraged for Cross-Site Scripting.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bootstrapped | wp_recipe_maker | <= 9.1.0 | — |
| brechtvds | wp_recipe_maker | <= 9.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
WP Recipe Maker Plugin up to 9.1.0 on WordPress path traversal (ID 3019769)
vuldb·2026-04-11·CVSS 5.4
CVE-2024-0380 [MEDIUM] WP Recipe Maker Plugin up to 9.1.0 on WordPress path traversal (ID 3019769)
A vulnerability classified as critical has been found in WP Recipe Maker Plugin up to 9.1.0 on WordPress. The affected element is an unknown function. The manipulation leads to path traversal.
This vulnerability is documented as CVE-2024-0380. The attack requires being on the local network. There is not any exploit available.
GHSA
GHSA-wf9p-gjmq-pmx9: The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9
ghsa_unreviewed·2024-02-06
CVE-2024-0380 [MEDIUM] CWE-22 GHSA-wf9p-gjmq-pmx9: The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9
The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' attribute used in Shortcodes. This makes it possible for authenticated attackers, with contributor-level access and above, to include the contents of SVG files on the server, which can be leveraged for Cross-Site Scripting.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/class-wprm-icon.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/457c4e56-c2a0-451f-a4a6-e7fb7bf7b0e0?source=cvehttps://plugins.trac.wordpress.org/changeset/3019769/wp-recipe-maker/trunk/includes/public/class-wprm-icon.phphttps://www.wordfence.com/threat-intel/vulnerabilities/id/457c4e56-c2a0-451f-a4a6-e7fb7bf7b0e0?source=cve
2024-02-05
Published