CVE-2024-50493 — AI Deep Analysis Summary

🚨 **Essence**: Arbitrary File Upload in WordPress plugin 'Automatic Translation'. 💥 **Consequences**: Attackers upload malicious files (e.g., webshells).…

🛡️ **Root Cause**: **CWE-434** (Unrestricted Upload of File with Dangerous Type). 🔍 **Flaw**: Missing file type validation in the upload mechanism. The plugin accepts ANY file extension without checking if it is safe.

📦 **Affected**: WordPress Plugin **Automatic Translation**. 📅 **Versions**: **1.0.4 and earlier**. 🏢 **Vendor**: masterhomepage. 🌐 **Platform**: WordPress sites running this specific plugin.

💀 **Attacker Actions**: Upload arbitrary files (PHP shells, scripts). 🔓 **Privileges**: **Unauthenticated** access required. 📊 **Impact**: Full control over the server.…

⚡ **Threshold**: **VERY LOW**. 🔑 **Auth**: **None required** (Unauthenticated). 🎯 **Complexity**: Low (AC:L). Simple HTTP POST request needed. No user interaction required (UI:N).

🔓 **Exploit**: **YES**, Public POC available. 📂 **Source**: GitHub (RandomRobbieBF/CVE-2024-50493). 📝 **Details**: Curl command provided for arbitrary file upload. Wild exploitation is highly likely due to ease of use.

🔍 **Self-Check**: Scan for plugin 'Automatic Translation' version <= 1.0.4. 🧪 **Test**: Attempt to upload a `.php` file via the plugin's upload interface. 📡 **Tools**: Use vulnerability scanners (e.g., Patchstack, WPScan…

🛠️ **Fix**: Update plugin to **version 1.0.5 or later** (implied by '1.0.4 and earlier' being vulnerable). 📥 **Action**: Check WordPress dashboard for updates.…

🚧 **Workaround**: **Disable or Delete** the 'Automatic Translation' plugin if no update is available. 🛑 **Mitigation**: Block upload endpoints via WAF (Web Application Firewall) if possible. 🔒 **Hardening**: Restrict fil…

🔥 **Priority**: **CRITICAL / IMMEDIATE**. ⏳ **Urgency**: High. CVSS 9.8 + Unauthenticated + Public POC = Active Threat. 🚀 **Action**: Patch or disable **TODAY**. Do not wait for scheduled maintenance.