What is the CVSS score of CVE-2024-50482?

CVE-2024-50482 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 55.5%.

Which versions of Woocommerce Product Design are affected by CVE-2024-50482?

The Woocommerce Product Design plugin (versions up to 1.0.0) contains a critical remote file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary code, creating…

How to fix or mitigate CVE-2024-50482?

24 hours: Immediately deactivate and remove the Woocommerce Product Design plugin from all WordPress installations; audit /wp-content/uploads and plugin directories for suspicious files created in the last 30 days. 7 days: If plugin functionality is business-critical, implement WAF rules to block PHP and executable file uploads to the plugin directory and restrict access to file upload endpoints by IP allowlist; evaluate alternative actively-maintained plugins. 30 days: Complete migration away from this plugin; if discontinuation is not possible, implement strict file type validation at the application level, disable executable permissions on upload directories via server configuration, and deploy continuous file integrity monitoring.

Woocommerce Product Design CVE-2024-50482

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-10-29 audit@patchstack.com

File Upload WordPress

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

10.0 (CRITICAL)

CVE Published

Oct 29, 2024 - 08:15 nvd

N/A

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Upload a Web Shell to a Web Server.This issue affects Woocommerce Product Design: from n/a through <= 1.0.0.

AnalysisAI

Unrestricted file upload in the Chetan Khandla 'Woocommerce Product Design' WordPress plugin (versions up to and including 1.0.0) allows remote unauthenticated attackers to upload arbitrary files, including web shells, achieving full server compromise. The flaw carries a maximum CVSS score of 10.0 with scope change, and EPSS places it in the 98th percentile (55.5% probability of exploitation), though no public exploit identified at time of analysis and it is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) affecting a WordPress plugin that extends WooCommerce with product design/customization functionality. WordPress plugins commonly expose file upload endpoints via admin-ajax.php or REST routes, and when MIME type, extension, and content validation are missing or bypassable, PHP files can be written into a web-accessible directory (typically wp-content/uploads/). Once written, the PHP interpreter on the web server executes the uploaded file on request, yielding remote code execution in the context of the web server user. The Patchstack-issued advisory and the WordPress tag indicate this is a typical plugin-level input-validation failure rather than a core WordPress flaw.

Affected ProductsAI

Chetan Khandla 'Woocommerce Product Design' WordPress plugin (slug: woo-product-design), all versions from initial release up to and including 1.0.0. No CPE was provided in the input data. The vulnerability was reported and disclosed via Patchstack (audit@patchstack.com); consult the Patchstack advisory database under the woo-product-design slug for the canonical entry and any vendor advisory link.

RemediationAI

No vendor-released patch identified at time of analysis - version 1.0.0 is the latest affected release and no fixed version is named in the supplied data. The safest action is to immediately deactivate and delete the woo-product-design plugin from any WordPress installation until the vendor publishes a patched release; check the Patchstack advisory for the woo-product-design slug for the latest status. If the plugin must remain installed due to business need, restrict access to /wp-admin and the plugin's upload endpoint via WAF rules or .htaccess IP allowlisting (side effect: legitimate customer-facing design uploads will break), and add filesystem-level restrictions to disable PHP execution inside wp-content/uploads/ via an Apache 'php_flag engine off' or nginx location block (side effect: any plugin that legitimately serves PHP from uploads will fail). Monitor wp-content/uploads/ for newly written .php, .phtml, .phar, or .htaccess files as a detection compensating control.