CVE-2024-31210

score

<0.1

cvss

7.6

epss

0.9%

published

2024-04-04

kev added

—

first seen

2026-10-21

WordPress versions prior to 6.4.3 contain a remote code execution caused by improper handling of plugin uploads when FTP credentials are required and 'DISALLOW_FILE_EDIT' is true, letting administrator users execute arbitrary PHP code, exploit requires administrator privileges and FTP credentials.