CVE-2024-13544: Zarinpal Paid Downloads <= 2.3 - Admin+ Arbitrary File Upload
Description
The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup)
Classification
CVE ID: CVE-2024-13544
Affected Products
Vendor: Unknown
Product: Zarinpal Paid Download
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.05% (probability of being exploited)
EPSS Percentile: 16.76% (scored less or equal to compared to others)
EPSS Date: 2025-03-12 (when was this score calculated)