Description
The Wux Blog Editor plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'wuxbt_insertImageNew' function in versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jurredeklijn | Wux Blog Editor | ≤ 3.0.0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 3 repositories
-
RandomRobbieBF/CVE-2024-9932 ★ 3 · Nov 5, 2024
Wux Blog Editor <= 3.0.0 - Unauthenticated Arbitrary File Upload
-
JoshuaProvoste/0-click-RCE-Exploit-for-CVE-2024-9932 ★ 2 · Jan 22, 2026
Unauthenticated 0-click RCE exploit for CVE-2024-9932. Exploits an arbitrary file upload vulnerability in the Wux Blog Editor WordPress plugin to upload a remote PHP payload, detect the target operat…
-
Nxploited/CVE-2024-9932-POC ★ 0 · Jan 11, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.