CVE-2024-8756

The Quform - WordPress Form Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the 'saveUploadedFile' function. This makes it possible for unauthenticated attackers to extract sensitive data, such as Personally Identifiable Information, from files uploaded by users. Files uploaded via forms created before version 2.21.0 will remain vulnerable to exposure after upgrading. To fully patch the plugin, site administrators should download any previously uploaded files, delete previously existing files and forms, and create the forms again after upgrading to version 2.21.0.

• CWE-200

• https://codecanyon.net/item/quform-wordpress-form-builder/706149
• https://www.wordfence.com/threat-intel/vulnerabilities/id/beb8ea66-3cd7-452f-9e64-8439de0ddc55?source=cve

Published

Nov 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8750Cross-site Scripting (XSS) vulnerability in idoit pro versio…6.1
• CVE-2024-8751A vulnerability allows a remote unauthenticated attacker to …7.5
• CVE-2024-8752The Windows version of WebIQ 2.15.9 is affected by a directo…7.5
• CVE-2024-8753Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-8754An issue has been discovered in GitLab EE/CE affecting all v…8.1
• CVE-2024-8755Improper Input Validation vulnerability of Authenticated Use…9.8
• CVE-2024-8757The WP Post Author – Boost Your Blog's Engagement with …7.2
• CVE-2024-8758The Quiz and Survey Master (QSM) WordPress plugin before 9.…4.8
• CVE-2024-8759The Nested Pages WordPress plugin before 3.2.9 does not sani…4.8
• CVE-2024-8760The Stackable – Page Builder Gutenberg Blocks plugin for Wor…5.3
• CVE-2024-8761The Share This Image plugin for WordPress is vulnerable to O…6.1
• CVE-2024-8762A vulnerability was found in code-projects Crud Operation Sy…9.8