High severity · published Jul 23, 2024
CVE-2024-6828
Redux Framework 4.4.12 - 4.4.17 - Unauthenticated JSON File Upload to Stored Cross-Site Scripting
7.2
CVSS
1%
EPSS
No
On KEV
Description
The Redux Framework plugin for WordPress is vulnerable to unauthenticated JSON file uploads due to missing authorization and capability checks on the Redux_Color_Scheme_Import function in versions 4.4.12 to 4.4.17. This makes it possible for unauthenticated attackers to upload JSON files, which can be used to conduct stored cross-site scripting attacks and, in some rare cases, when the wp_filesystem fails to initialize - to Remote Code Execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Redux Framework · davidanderson
4.4.12 through 4.4.17 · source: vendor
GT
Gutenberg Template Library \& Redux Framework · Redux
4.4.12 through 4.4.17 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6828
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6828
core.trac.wordpress.org
https://core.trac.wordpress.org/browser/tags/6.5.4/src/wp-includes/class-wp-theme-json.php#L1690
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/classes/class-redux-filesystem.php#L614
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/classes/class-redux-helpers.php#L938
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/extensions/color_scheme/color_scheme/class-redux-color-scheme-import.php#L75
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/redux-framework/tags/4.4.17/redux-core/inc/fields/typography/redux-typography.js#L646
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/redux-framework/trunk/redux-core/inc/classes/class-redux-filesystem.php#L166
More from Redux Framework
6.8
CVE-2025-14123
Redux Framework <= 4.5.11 – Authenticated (Subscriber+) Privilege Escalation via Users Extension
6.4
CVE-2026-90992
Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
6.4
CVE-2026-5410
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
6.4
CVE-2026-5400
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
6.4
CVE-2026-5399
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value