blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2024-6000

HIGH 7.1 CVSS 3.1
Published
June 15, 2024
Last modified
June 17, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-285
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Description

The FooEvents for WooCommerce plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability setting on the 'display_ticket_themes_page' function in versions up to, and including, 1.19.20. This makes it possible for authenticated attackers with contributor-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This was partially patched in 1.19.20, and fully patched in 1.19.21.

Affected products and versions

  • FooEvents FooEvents for WooCommerce — Up to and including 1.19.20
  • fooevents fooevents — Before 1.19.21

References

  • help.fooevents.com https://help.fooevents.com/docs/topics/changelogs/fooevents-for-woocommerce/
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/1080810b-ec9a-44fb-b4da-49b28646a441?source=cve
  • nvd.nist.gov Official NVD record