Tourfic CVE-2024-29135

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-03-19 audit@patchstack.com

WordPress File Upload Tourfic Wordpress Plugin Themefic

9.9

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

4

Severity Changed

Apr 29, 2026 - 10:22 NVD

HIGH CRITICAL

CVSS changed

Apr 29, 2026 - 10:22 NVD

8.8 (HIGH) 9.9 (CRITICAL)

CVE Published

Mar 19, 2024 - 14:15 nvd

HIGH 8.8

CVE Published

Mar 19, 2024 - 14:15 cve.org

CRITICAL 9.9

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.15.

AnalysisAI

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.11.15. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.11.15. Affected products include: Themefic Tourfic.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Tourfic

View all

CVE-2024-29137 HIGH This Week POC

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic t

CVE-2025-24650 CRITICAL Act Now

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic allows Upload a Web Shell to a Web Ser

CVE-2024-29136 HIGH This Week

Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.11.17. Rated high severity (CVSS 8.5), this

CVE-2026-27999 MEDIUM This Month

Broken Access Control in the Tourfic WordPress plugin (all versions up to and including 2.23.1) allows authenticated sub

CVE-2024-29134 MEDIUM This Month

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic t

CVE-2026-57395 MEDIUM This Month

Missing Authorization (CWE-862) in the Tourfic WordPress plugin through version 2.22.5 permits authenticated low-privile

CVE-2026-57392 MEDIUM This Month

Tourfic, a WordPress travel booking plugin by Themefic, exposes unauthenticated access control bypass through missing au

CVE-2024-12032 MEDIUM This Month

The Tourfic - Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin f

CVE-2026-39543 MEDIUM This Month

Missing authorization in Themefic Tourfic WordPress plugin versions up to 2.21.4 allows unauthenticated remote attackers

CVE-2024-8319 MEDIUM This Month

The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all

CVE-2016-3088 CRITICAL POC

CVE-2021-31207 MEDIUM POC

CVE-2017-12617 HIGH POC

CVE-2024-50623 CRITICAL POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2018-9206 CRITICAL POC

CVE-2024-5084 CRITICAL POC

Same technique File Upload

View all

CVE-2016-3088 CRITICAL POC

CVE-2017-12617 HIGH POC

CVE-2020-1938 CRITICAL POC

CVE-2024-50623 CRITICAL POC

CVE-2017-11357 CRITICAL POC

CVE-2017-12615 HIGH POC

CVE-2018-9206 CRITICAL POC

CVE-2024-5084 CRITICAL POC

Share

CVE-2024-29135 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy