CVE-2024-50527
📛 CVE Title
WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Arbitrary File Upload vulnerability
Description
Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web Server.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- Patchstack
- CVSS severity
- CRITICAL
- CVSS score
- 10.0 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Effective score
- 10.0 / 10 CRITICAL source: CNA overview
- CWE(s)
-
CWE-434 - Reserved
- 2024-10-24
- Published
- 2024-11-04 14:42 UTC
- Last updated
- 2026-05-11 23:38 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/50xxx/CVE-2024-50527.json
- Linked Threat
- CVE-2024-50527 — Stacks Mobile App Builder <= 5.2.3 - Unauthenticated Arbitrary File Upload
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2024-44940 - Assigner
- Patchstack
- Published
- Nov 4, 2024, 1:42:39 PM
- Updated
- May 11, 2026, 9:38:01 PM
- EUVD base score (CVSS 3.1)
-
10.0 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EUVD-reported EPSS
- 0.8900
- Vendors
- Stacks
- Products
-
Stacks Mobile App Builder (n/a ≤5.2.3)Stacks Mobile App Builder (0 ≤5.2.3)
- Aliases
-
GHSA-wvc6-c72c-8m45
ENISA description: Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web Server.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Stacks | Stacks Mobile App Builder |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Indicators (2)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| domain |
server.this
|
no local data | 2026-05-18 21:19 UTC |
| cve |
CVE-2024-50527
|
no local data | 2026-06-06 14:16 UTC |
Remediations (23)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:nvd.nist.gov
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
2026-08-06 03:36 UTC -
web:www.microsoft.com
Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed. You can choose the type of updates for which you want to be notified: Major ...
2026-08-06 03:36 UTC -
web:www.nist.gov
NIST maintains the National Vulnerability Database (NVD), a repository of information on software and hardware flaws that can compromise computer security. This is a key piece of the nation's cybersecurity infrastructure.
2026-08-06 03:36 UTC -
web:support.microsoft.com
Hotpatch for Windows 11 Enterprise, version 25H2 gives organizations the ability to apply security updates without requiring a device restart. This helps maintain security while keeping workflows uninterrupted. Hotpatch is an extension of Windows Update and requires Autopatch to create and deploy updates to devices enrolled in the Autopatch quality update policy. Benefits include: Immediate ...
2026-08-06 03:36 UTC -
web:www.oracle.com
Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.
2026-08-06 03:36 UTC -
web:support.microsoft.com
It includes updates from previous security and non-security releases, along with an additional fix . To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained.
2026-08-06 03:36 UTC -
web:learn.microsoft.com
Windows 11, version 25H2 is now available for all eligible devices. Devices running Home and Pro editions of Windows 11 that are not managed by IT departments will receive the update to Windows 11, version 25H2 through the machine learning-based intelligent rollout.
2026-08-06 03:36 UTC -
Wordfence remediation: Stacks Mobile App Builder – The most powerful Mobile Applications Drag and Drop builderWordfence
No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
2026-06-06 14:16 UTC -
web:www.esri.com
Key highlights The ArcGIS Server Security 2025 update 2 is available This patch resolves 10 Medium severity vulnerabilities This security patch is cumulative, and includes fixes provided in the ArcGIS Server Security 2025 update 1.
2026-05-22 10:41 UTC -
web:krebsonsecurity.com
But with a threat score of 9.8 out of possible 10 and marked "exploitation more likely," CVE -2025-59287 can be exploited without authentication and is an easy " patch now" candidate.
2026-05-22 10:41 UTC -
web:support.servicenow.com
Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...
2026-05-22 10:41 UTC -
web:www.oracle.com
This Critical Patch Update contains 374 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at October 2025 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 10:41 UTC -
web:www.allrecipes.com
No matter which brand you buy, even the best frozen pizzas can fall flat if they aren't cooked properly. As much as we adore the convenience of a frozen pizza, a pie with a soggy crust or uncooked cheese is a major disappointment. So we asked chefs to share their pro tips about how to cook frozen pizza to crispy, cheesy perfection.
2026-05-22 10:41 UTC -
web:www.bleepingcomputer.com
Microsoft says customers in restricted network environments may encounter Windows Update failures after installing the January 2026 optional non-security preview updates.
2026-05-22 02:51 UTC -
web:betanews.com
Another month, another update for Windows which is problematic. This time around, it is the May 2026 Windows 11 security update - or the KB5089549 update.
2026-05-22 02:51 UTC -
web:cybersecuritynews.com
Microsoft released an out-of-band hotpatch update on March 13, 2026, addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2.
2026-05-22 02:51 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 02:51 UTC -
web:arstechnica.com
Found in the wild: 2 Secure Boot exploits. Microsoft is patching only 1 of them. The publicly available exploits provide a near-universal way to bypass key protections.
2026-05-22 02:51 UTC -
web:www.computerworld.com
Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...
2026-05-22 02:51 UTC -
web:www.ninjaone.com
Overview KB5087054 is a cumulative security and reliability update for the .NET Framework targeting Windows 11 version 24H2 systems. Released on May 12, 2026, this patch addresses critical vulnerabilities affecting both .NET Framework 3.5 and 4.8.1 installations. The update is designed to be deployed as part of standard maintenance routines and is available through multiple distribution ...
2026-05-22 02:51 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 02:51 UTC -
web:www.virustotal.com
VirusTotal is a platform for scanning files and URLs for viruses, malware, and other threats using multiple antivirus engines.
2026-05-22 02:51 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-22 02:51 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2024-50527.json.
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:stacks:stacks_mobile_app_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "stacks_mobile_app_builder",
"vendor": "stacks",
"versions": [
{
"lessThanOrEqual": "5.2.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-50527",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-04T16:33:54.044243Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-11T21:38:01.370Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unaffected",
"packageName": "stacks-mobile-app-builder",
"product": "Stacks Mobile App Builder",
"vendor": "Stacks",
"versions": [
{
"lessThanOrEqual": "5.2.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "stealthcopter | Patchstack Bug Bounty Program"
}
],
"datePublic": "2026-04-01T16:28:55.176Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web Server.<p>This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.</p>"
}
],
"value": "Unrestricted Upload of File with Dangerous Type vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Upload a Web Shell to a Web Server.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3."
}
],
"impacts": [
{
"capecId": "CAPEC-650",
"descriptions": [
{
"lang": "en",
"value": "Upload a Web Shell to a Web Server"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-28T16:10:31.154Z",
"orgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"shortName": "Patchstack"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://patchstack.com/database/Wordpress/Plugin/stacks-mobile-app-builder/vulnerability/wordpress-stacks-mobile-app-builder-plugin-5-2-3-arbitrary-file-upload-vulnerability?_s_id=cve"
}
],
"title": "WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Arbitrary File Upload vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3",
"assignerShortName": "Patchstack",
"cveId": "CVE-2024-50527",
"datePublished": "2024-11-04T13:42:39.371Z",
"dateReserved": "2024-10-24T07:27:40.366Z",
"dateUpdated": "2026-05-11T21:38:01.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}