What is CVE-2024-10586?

CVE-2024-10586 is a critical-severity vulnerability in Eugenbobrowski Debug Tool, classified under Missing Authorization. CVSS score: 9.8/10. Published 2024-11-09.

How severe is CVE-2024-10586?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2024-10586 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Eugenbobrowski Debug Tool

CVE-2024-10586

The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbt_pull_image() function and missing file type validation in all versions up to, and including, 2.2. This makes it possible for unauthenticated attackers to to create arbitrary files such as .php files that can be leveraged for remote code execution. CVE-2024-52416 may be a duplicate of this issue.

Vulnerability class: Broken Access Control

EPSS: 0.021 (79.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Eugenbobrowski Debug Tool — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-10586?: CVE-2024-10586 is a critical-severity vulnerability in Eugenbobrowski Debug Tool, classified under Missing Authorization. CVSS score: 9.8/10. Published 2024-11-09.
How severe is CVE-2024-10586?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2024-10586 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.