CVE-2024-10672— Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-10672
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the mpg_upsert_project_source_block() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with editor-level access and above, to delete limited files on the server.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
文件名或路径的外部可控制
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin Multiple Page Generator Plugin – MPG 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Multiple Page Generator Plugin – MPG 4.0.2版本及之前版本存在安全漏洞，该漏洞源于mpg_upsert_project_source_block函数中的文件路径验证不足而导致任意文件删除
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| themeisle | Multiple Page Generator Plugin – MPG | * ~ 4.0.2 | - |
II. Public POCs for CVE-2024-10672
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-10672
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: Multiple Page Generator Plugin – MPG
- CVE-2024-10705
Multiple Page Generator Plugin – MPG <= 4.0.5 - Authenticate - CVE-2024-7424
Multiple Page Generator Plugin – MPG <= 4.0.1 - Missing Auth - CVE-2024-31301
WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4 - CVE-2024-27951
WordPress Multiple Page Generator Plugin <= 3.4.0 - Auth. Re - CVE-2024-30235
WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4
Same vendor: themeisle
- CVE-2026-2892
Otter Blocks <= 3.1.4 - Improper Authorization to Unauthenti - CVE-2026-25366
WordPress Woody ad snippets plugin <= 2.7.1 - Remote Code Ex - CVE-2026-2410
Disable Admin Notices – Hide Dashboard Notifications <= 1.4. - CVE-2026-1319
Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Sto - CVE-2026-1755
Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+)
Same weakness: CWE-73
- CVE-2026-41693
i18next-fs-backend: Path traversal via unsanitised lng/ns al - CVE-2026-44127
Local File Inclusion (LFI) and Arbitrary File Deletion - CVE-2026-7633
Totolink N300RH cstecgi.cgi setUploadSetting file inclusion - CVE-2026-42424
OpenClaw < 2026.4.8 - Local File Exfiltration via Shared Rep - CVE-2026-41177
Squidex has Blind SSRF via file:// Protocol in Restore API l
V. Comments for CVE-2024-10672
No comments yet