CVE-2024-12209

The WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.17.0 via the 'filename' parameter of the 'umbrella-restore' action. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

• CWE-98

• https://plugins.trac.wordpress.org/browser/wp-health/tags/v2.16.4/src/Actions/RestoreRouter.php#L45
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3202883%40wp-health&new=3202883%40wp-health&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c74ce3e8-cab9-4cc6-a1ad-1e51f7268474?source=cve

Published

Dec 8, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12203The RSS Icon Widget plugin for WordPress is vulnerable to St…4.4
• CVE-2024-12204The Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcem…5.4
• CVE-2024-12205The Themesflat Addons For Elementor plugin for WordPress is …5.4
• CVE-2024-12206The WordPress Header Builder Plugin – Pearl plugin for WordP…4.3
• CVE-2024-12207The Toggles Shortcode and Widget plugin for WordPress is vul…4.4
• CVE-2024-12208Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-1221This vulnerability potentially allows files on a PaperCut NG…3.1
• CVE-2024-12210The Print Invoice & Delivery Notes for WooCommerce plugin fo…4.3
• CVE-2024-12211Pega Platform versions 8.1 to Infinity 24.2.0 are affected b…5.4
• CVE-2024-12212The vulnerability occurs in the parsing of CSP files. The is…8.5
• CVE-2024-12213The WP Job Board Pro plugin for WordPress is vulnerable to p…9.8
• CVE-2024-12214The WooCommerce HSS Extension for Streaming Video plugin for…6.1