Loading vulnerability…
CVE-2024-54262 is an Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in the Import Export For WooCommerce plugin, affecting versions up to and including 1.5. The vulnerability allows an attacker to upload arbitrary files, such as web shells, to the web server without proper validation or restriction of file type.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Python exploit script (CVE-2024-54262.py) and a README.md for CVE-2024-54262, an arbitrary file upload vulnerability in the 'Import Export for WooCommerce' WordPress plugin (version 1.5 and below). The exploit works by first checking the plugin version via the public readme.txt file, then logging in to WordPress using provided credentials, and finally uploading a user-supplied PHP shell via a crafted multipart/form-data POST request to the admin-ajax.php endpoint. If successful, the shell is placed in the 'wp-content/uploads/import-export-for-woocommerce/product/' directory, enabling remote code execution. The script is operational, requiring valid credentials and a vulnerable plugin version, and provides a customizable PHP payload for post-exploitation. The repository is well-structured, with clear usage instructions and output explanations in the README.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.