Skip to content
Sign in
8.8 High

CVE-2024-12848 The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on…

Description

The SKT Page Builder plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the 'addLibraryByArchive' function in all versions up to, and including, 4.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files that make remote code execution possible.

Affected products and versions

Product Affected versions Fixed in
SKT Page Builder 4.7 earliest → 4.7 No fix stated

Other CVEs of SKT Page Builder

The 3 CVEs of SKT Page Builder →
CVE-2025-54005 Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly… 4.3 Medium CVE-2024-1337 The SKT Page Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability… 4.3 Medium
Track this CVE