CVE-2024-10590

The Opt-In Downloads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_upload() function in all versions up to, and including, 4.07. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Due to the presence of an .htaccess file, this can only be exploited to achieve RCE on NGINX servers, unless another vulnerability is present.

• CWE-434

• https://codecanyon.net/item/subscribe-download/2687305
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5c3c20b8-12cf-4ce6-a1d4-99204df33fcd?source=cve

Published

Dec 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10585The InfiniteWP Client plugin for WordPress is vulnerable to …5.3
• CVE-2024-10586The Debug Tool plugin for WordPress is vulnerable to arbitra…9.8
• CVE-2024-10587The Interactive Contact Form and Multi Step Form Builder wit…8.8
• CVE-2024-10588The Debug Tool plugin for WordPress is vulnerable to unautho…4.3
• CVE-2024-10589The Leopard - WordPress Offload Media plugin for WordPress i…9.8
• CVE-2024-1059Use after free in Peer Connection in Google Chrome prior to …8.8
• CVE-2024-10591The MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email…8.8
• CVE-2024-10592The Mapster WP Maps plugin for WordPress is vulnerable to St…6.4
• CVE-2024-10593The WPForms – Easy Form Builder for WordPress – Contact Form…4.3
• CVE-2024-10594A vulnerability was found in ESAFENET CDG 5. It has been cla…8.8
• CVE-2024-10595A vulnerability was found in ESAFENET CDG 5. It has been dec…9.8
• CVE-2024-10596A vulnerability was found in ESAFENET CDG 5. It has been rat…8.8