CRITICAL CWE-862
CVE-2024-9234
GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
Ataurr·GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
9.8/ 10
CVSS 3.1
Critical severity
10%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 96% of all CVEs
Not listed
CISA KEV catalog
No confirmed in-the-wild exploitation on CISA's list.
Timeline
- Published
- Oct 11, 2024
- Updated
- Apr 8, 2026
- First covered
- Jul 11, 2026
- Latest story
- 4 months ago
Summary
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-plugin REST API endpoint) in all versions up to, and including, 2.1.0. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins, or utilize the functionality to upload arbitrary files spoofed like plugins.
CWE-862Missing Authorization
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
- Ataurr GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editorup to 2.1.0