CVE
CVE-2024-5450
bug_library_project · bug_library
- First Reported
- Nov 6, 2026
- Latest Reported
- Nov 6, 2026
CVE Enrichment
- CVSS
- 9.1 CRITICAL
- EPSS
- 3.35%
- EPSS Percentile
- 88.74%
- CISA KEV
- Not listed
Description
The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- [email protected]
- Published
- 13-Jul-2024 13:15
- Last Modified
- 17-Jun-2026 15:15
- EPSS Date
- 2026-11-07
- CWE
- CWE-434
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:N /
UI:N /
S:U /
C:N /
I:H /
A:H
CNA Products / Version Status
- bug_library_project · bug_library
Source: CNA · 134c704f-9b21-4f2e-91b3-4a467353bcc0
Default status: unaffected
0 ≤ version < 2.1.1 — affected (custom)
CPEs: cpe:2.3:a:bug_library_project:bug_library:*:*:*:*:*:wordpress:*:*
- Unknown · Bug Library
Source: CNA · [email protected]
Default status: unaffected
0 ≤ version < 2.1.1 — affected (semver)
Affected Products / Versions
- bug_library_project / bug_library
Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 2.1.1
cpe:2.3:a:bug_library_project:bug_library:*:*:*:*:*:wordpress:*:*
References
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- CVE reference: CVE-2024-5450 Metasploit Framework 6.5.9 Adds RCE Modules for Network Devices, GitLab and More
CVE (6)
People (2)
Vendors (4)
Products (10)
Tools (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.