What is the CVSS score of CVE-2024-52380?

CVE-2024-52380 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 54.3%.

Which versions of Picsmize are affected by CVE-2024-52380?

The Picsmize plugin (versions 1.0.0 and earlier) exposes any WordPress installation to complete server takeover via unauthenticated file upload.

How to fix or mitigate CVE-2024-52380?

24 hours: Identify all WordPress installations running Picsmize plugin (all versions through 1.0.0); deactivate and uninstall the plugin immediately; document any custom configuration for migration planning. 7 days: Deploy Web Application Firewall rules to block the plugin's upload endpoints, configure upload directory permissions to prevent script execution, and implement file integrity monitoring on wp-content/uploads. 30 days: Migrate to an alternative image processing solution (e.g., Imagify, ShortPixel) and confirm plugin code removal; perform security audit of affected servers for backdoors or persistence mechanisms.

Picsmize CVE-2024-52380

CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2024-11-14 audit@patchstack.com

File Upload

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:22 NVD

10.0 (CRITICAL)

CVE Published

Nov 14, 2024 - 18:15 nvd

N/A

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in softpulseinfotech Picsmize picsmize allows Upload a Web Shell to a Web Server.This issue affects Picsmize: from n/a through <= 1.0.0.

AnalysisAI

Unrestricted file upload in softpulseinfotech Picsmize plugin (versions up to and including 1.0.0) allows remote unauthenticated attackers to upload web shells and achieve full server compromise. CVSS 10.0 with a scope-changed vector reflects the severity, and the EPSS score of 54.26% (98th percentile) indicates elevated likelihood of exploitation attempts, though no public exploit identified at time of analysis.

Technical ContextAI

Picsmize is a WordPress plugin developed by softpulseinfotech, identified through the Patchstack audit program which specializes in WordPress ecosystem vulnerabilities. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type), where the plugin fails to validate file extensions, MIME types, or content before accepting uploaded files. This class of flaw typically arises when upload handlers trust client-supplied filename or Content-Type fields and write files into web-accessible directories, allowing PHP or other executable content to be served by the web server.

Affected ProductsAI

softpulseinfotech Picsmize WordPress plugin, all versions from initial release through 1.0.0 inclusive, as reported via the Patchstack audit (audit@patchstack.com). The upper bound 'n/a through <= 1.0.0' from the advisory suggests no fixed version was identified at disclosure; CPE strings were not provided in the available data.

RemediationAI

No vendor-released patch identified at time of analysis - version 1.0.0 is the latest known release and remains vulnerable. The most reliable mitigation is to deactivate and uninstall the Picsmize plugin until softpulseinfotech ships a fixed version, accepting the loss of any image-processing functionality it provides. As compensating controls, restrict access to the plugin's upload endpoints via WordPress's .htaccess or web server rules to block direct POSTs from untrusted networks, disable PHP execution in wp-content/uploads (or wherever the plugin writes files) using a Files directive to prevent uploaded shells from running, and monitor the Patchstack advisory page for an eventual fix release.