WordPress Plugin Vulnerabilities

WP-Lister Lite for eBay < 3.6.0 - Authenticated (Shop Manager+) Arbitrary File Upload

Description

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to 3.6.0 (exclusive). This makes it possible for authenticated attackers, with shop manager-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affects Plugins

Plugin icon
wp-lister-for-ebay
Fixed in 3.6.0

References

CVE
CVE-2024-32836
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/7179fe0d-8cfa-4b43-82d6-5523d65ff780

Miscellaneous

Original Researcher
Joshua Chan
Verified
No
WPVDB ID
527794ff-e8b2-489e-95b6-c72912360bf4

Timeline

Publicly Published
2024-04-22 (about 2 years ago)
Added
2024-04-29 (about 2 years ago)
Last Updated
2024-04-29 (about 2 years ago)

Other

Published
Title
Published
2025-10-10
Title
Ovatheme Events Manager < 1.8.6 - Unauthenticated Arbitrary File Upload
Published
2014-08-01
Title
Magn WP Drag & Drop <= 1.1.4 - Upload Shell Upload
Published
2021-02-18
Title
Backup Guard < 1.6.0 - Authenticated Arbitrary File Upload
Published
2024-10-17
Title
Sovratec Case Management <= 1.0.0 - Unauthenticated Arbitrary File Upload
Published
2014-08-01
Title
SFBrowser 1.4.5 - connectors/php/sfbrowser.php File Upload PHP Code Execution