What is the CVSS score of CVE-2024-50494?

CVE-2024-50494 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.0%.

Which versions of Sudan Payment Gateway for WooCommerce are affected by CVE-2024-50494?

Sudan Payment Gateway for WooCommerce plugin (versions 1.2.2 and earlier) enables unauthenticated remote attackers to upload arbitrary files and achieve complete server compromise, directly…

How to fix or mitigate CVE-2024-50494?

Within 24 hours: Audit all WordPress installations for Sudan Payment Gateway ≤1.2.2; immediately disable the plugin or take affected systems offline; preserve logs for forensic analysis. Within 7 days: Complete forensic investigation for compromise indicators; evaluate alternative payment solutions and monitor vendor advisories for patch availability. Within 30 days: Deploy replacement payment gateway or, if version >1.2.2 is released, implement the compensating controls below before re-enabling.

Sudan Payment Gateway for WooCommerce CVE-2024-50494

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-10-29 audit@patchstack.com

File Upload WordPress

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

10.0 (CRITICAL)

CVE Published

Oct 29, 2024 - 08:15 nvd

N/A

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce wc-sudan-payment-gateway allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through <= 1.2.2.

AnalysisAI

Unrestricted file upload in the Sudan Payment Gateway for WooCommerce WordPress plugin (versions up to and including 1.2.2) allows remote unauthenticated attackers to upload arbitrary files, including web shells, to the underlying web server. With a CVSS 10.0 score reflecting network attack vector, no privileges, and changed scope, exploitation yields full server compromise; no public exploit identified at time of analysis, though EPSS places it at the 77th percentile indicating moderate predicted exploitation likelihood.

Technical ContextAI

The flaw is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) affecting the wc-sudan-payment-gateway plugin, a WooCommerce extension for processing Sudanese payment methods on WordPress sites. The plugin exposes a file upload handler that fails to validate file type, extension, or content before persisting uploads to a web-accessible location. Because WordPress executes PHP from many directories by default, an attacker can upload a PHP web shell and request it directly, gaining arbitrary code execution in the context of the web server user. The CVSS scope change (S:C) reflects that compromise of the plugin can pivot into the broader WordPress installation and potentially the underlying host.

Affected ProductsAI

The Sudan Payment Gateway for WooCommerce plugin (slug wc-sudan-payment-gateway) by Amin Omer Sudan, affecting all versions from initial release through and including 1.2.2 on WordPress sites running WooCommerce. No CPE strings were provided in the input data, and the vendor advisory was issued by Patchstack (audit@patchstack.com) as the reporting researcher organization.

RemediationAI

No vendor-released patched version is identified in the available data; the description states the issue affects versions through 1.2.2 with no fixed version specified, so administrators should immediately deactivate and remove the wc-sudan-payment-gateway plugin until a vendor fix is published and monitor the Patchstack advisory database for an update. As compensating controls, restrict access to the plugin's upload endpoints via web server rules (deny direct requests to plugin upload handlers), disable PHP execution within wp-content/uploads via .htaccess or nginx location blocks (side effect: breaks any legitimate plugin that relies on executing PHP from uploads), and deploy a WordPress-aware WAF with rules blocking unauthenticated file uploads to plugin endpoints. Audit the wp-content/uploads directory and plugin directories for unexpected PHP, phtml, or polyglot files indicating prior compromise.