CVE-2024-9047 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-22 (Path Traversal). 🐛 **Flaw**: The `wfu_file_downloader.php` file fails to sanitize user input, allowing directory traversal sequences to escape the target folder.

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: nickboss. 📦 **Product**: Iptanus File Upload (WordPress File Upload). 📅 **Affected**: Versions **4.24.11 and earlier**. ⚠️ **Note**: Exploitation requires **PHP 7.4 or earlier**.

Q: What can hackers do? (Privileges/Data)

🕵️ **Actions**: Arbitrary file read & delete. 🔓 **Privileges**: Unauthenticated access (No login needed). 💾 **Data**: Sensitive server files, config files, or source code outside the upload directory.

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: LOW. 🚫 **Auth**: None required (Unauthenticated). 🌐 **Vector**: Network (Remote). 🎯 **Ease**: High (CVSS 9.8 Critical).

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Yes**: Multiple public PoCs/Exploits available on GitHub. 📜 **Examples**: `iSee857`, `verylazytech`, `Nxploited`. 🐍 **Tools**: Python scripts for batch/single detection are circulating.

Q: How to self-check? (Features/Scanning)

🔍 **Check**: Use provided PoC scripts (e.g., `python poc.py -u your-ip`). 📡 **Scan**: Look for `wfu_file_downloader.php` endpoint. 📋 **Verify**: Check plugin version <= 4.24.11 and PHP version <= 7.4.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Update plugin to version **> 4.24.11**. 📢 **Source**: WordPress Trac changeset 3164449. 🔄 **Action**: Immediate upgrade recommended by vendor.

Q: Is it urgent? (Priority Suggestion)

🔴 **Priority**: CRITICAL / URGENT. 🚨 **Reason**: CVSS 9.8, Unauthenticated, Public Exploits. ⏳ **Action**: Patch **NOW**. Do not wait. High risk of active exploitation in the wild.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Critical Path Traversal in 'WordPress File Upload' plugin. 📉 **Consequences**: Attackers can read or delete files **outside** the intended directory.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-22 (Path Traversal). 🐛 **Flaw**: The `wfu_file_downloader.php` file fails to sanitize user input, allowing directory traversal sequences to escape the target folder.

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: nickboss. 📦 **Product**: Iptanus File Upload (WordPress File Upload). 📅 **Affected**: Versions **4.24.11 and earlier**. ⚠️ **Note**: Exploitation requires **PHP 7.4 or earlier**.

Q4What can hackers do? (Privileges/Data)

🕵️ **Actions**: Arbitrary file read & delete. 🔓 **Privileges**: Unauthenticated access (No login needed). 💾 **Data**: Sensitive server files, config files, or source code outside the upload directory.

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: LOW. 🚫 **Auth**: None required (Unauthenticated). 🌐 **Vector**: Network (Remote). 🎯 **Ease**: High (CVSS 9.8 Critical).

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔥 **Yes**: Multiple public PoCs/Exploits available on GitHub. 📜 **Examples**: `iSee857`, `verylazytech`, `Nxploited`. 🐍 **Tools**: Python scripts for batch/single detection are circulating.

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Use provided PoC scripts (e.g., `python poc.py -u your-ip`). 📡 **Scan**: Look for `wfu_file_downloader.php` endpoint. 📋 **Verify**: Check plugin version <= 4.24.11 and PHP version <= 7.4.

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Update plugin to version **> 4.24.11**. 📢 **Source**: WordPress Trac changeset 3164449. 🔄 **Action**: Immediate upgrade recommended by vendor.

Q9What if no patch? (Workaround)

🚧 **Workaround**: If patching is delayed, **disable the plugin** immediately. 🛑 **Block**: Restrict access to `wfu_file_downloader.php` via WAF or server config.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔴 **Priority**: CRITICAL / URGENT. 🚨 **Reason**: CVSS 9.8, Unauthenticated, Public Exploits. ⏳ **Action**: Patch **NOW**. Do not wait. High risk of active exploitation in the wild.

Continue exploring

Vulnerability detail Full AI analysis (login) nickboss CWE-22