{"id":"CVE-2024-7620","aliases":["EUVD-2024-48511","GHSA-3x6p-q4pv-82hr"],"status":"published","title":"Customizer Export/Import \u003c= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import","description":"The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00737,"percentile":0.5495,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-434"],"published":"2024-09-07T11:17:05Z","modified":"2026-06-17T08:20:33Z","products":[{"vendor":"beaverbuilder","product":"customizer export/import"},{"vendor":"fastlinemedia","product":"customizer_export\\/import"},{"vendor":"the_beaver_builder_team","product":"cutomizer_export\\/import"},{"vendor":"unknown","product":"customizer export/import"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/7600e7df-725d-4877-b0bf-5329f814723f?source=cve","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/3144365/customizer-export-import","tags":["Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7620"},{"url":"https://github.com/advisories/GHSA-3x6p-q4pv-82hr"}],"sources":{"cve":[{"id":"CVE-2024-7620","title":"Customizer Export/Import \u003c= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import","description":"The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.","status":"published","published":"2024-09-07T11:17:05.128Z","modified":"2026-04-08T17:01:26.412Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:20.673123Z"}],"euvd":[{"id":"EUVD-2024-48511","description":"The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.","status":"published","published":"2024-09-07T11:17:05Z","modified":"2026-04-08T17:01:26Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T19:24:53.403695Z"}],"ghsa":[{"id":"GHSA-3x6p-q4pv-82hr","title":"The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to...","description":"The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.","status":"published","published":"2024-09-07T12:30:44Z","modified":"2024-09-07T12:30:50Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:58:11.86243Z"}],"nvd":[{"id":"CVE-2024-7620","description":"The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.","status":"published","published":"2024-09-07T12:15:12.55Z","modified":"2026-06-17T08:20:33.907Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:10:24.514378Z"}]}}