CVE-2024-52376

CRITICAL

Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress boat-rental-system allows Upload a Web Shell to a Web Server.This issue affects Boat Renta...

Affects 0 products across 2 vendors.

CVSS 3.110.0
EPSS0.5%
Percentile42th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-434: Unrestricted Upload of File with Dangerous Type

Application allows file uploads without validating type, enabling upload of executable code or web shells.

Related Attack Patterns (CAPEC)
CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs
via CWE-434

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

The cmsMinds Boat Rental Plugin for WordPress contains a critical vulnerability that allows an attacker to upload a web shell to the web server, potentially leading to full server compromise.

BSID: BS-2024-GLOBAL-220172-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-52376?
The cmsMinds Boat Rental Plugin for WordPress contains a critical vulnerability that allows an attacker to upload a web shell to the web server, potentially leading to full server compromise.
What is the CVSS score for CVE-2024-52376?
CVE-2024-52376 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 0.5%.
Is CVE-2024-52376 actively exploited?
No confirmed active exploitation of CVE-2024-52376 as of 2026-05-30.
How do I remediate CVE-2024-52376?
Priority: IMMEDIATE.
What systems are affected by CVE-2024-52376?
CVE-2024-52376 affects Plugin; Wordpress.
Vulnerability Details
CVE IDCVE-2024-52376
BSIDBS-2024-GLOBAL-220172-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2024-11-14
Last Modified2026-04-23
ICS Relevance0%
Weakness (CWE)
Unrestricted Upload of File with Dangerous Type
SourceNVD
Official Description

Unrestricted Upload of File with Dangerous Type vulnerability in cmsMinds Boat Rental Plugin for WordPress boat-rental-system allows Upload a Web Shell to a Web Server.This issue affects Boat Rental Plugin for WordPress: from n/a through <= 1.0.1.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit the unrestricted file upload feature to upload a malicious file, such as a web shell, which can then be used to execute arbitrary code on the server.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Plugin — —
Wordpress — —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 700 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hasha4310d4b393c5bcbd48f3a8d60647140b0b365edf47b8cd213081546fd3c9cb21cab4bb5f49c911a6b841dcef8aa00b97a67ee3e063b0c940924a61a46aa24e4
Related CVEs affecting Plugin
CVE-2024-2086 10.0 The Integrate Google Drive – Browse, Upload, Download, Embed, Play, Share, Ga... CVE-2024-3820 10.0 The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin... CVE-2024-6500 10.0 The InPost for WooCommerce plugin and InPost PL plugin for WordPress are vuln... CVE-2025-53624 10.0 The Docusaurus gists plugin adds a page to your Docusaurus instance, displayi... CVE-2025-29009 10.0 Unrestricted Upload of File with Dangerous Type vulnerability in Webkul Medic...
View all Plugin CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →