We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2024-10938

CVE-2024-10938

WordPressPHP

Severity: MEDIUM
CVSS: 6.5CVSS
Published: 2026-02-27
Last modified: 2026-02-27
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CWE: CWE-506

Description

The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.

References

https://plugins.trac.wordpress.org/browser/moneytigo/tags/1.7.0/.htaccess
https://plugins.trac.wordpress.org/browser/moneytigo/tags/1.7.0/assets/.htaccess
https://www.wordfence.com/threat-intel/vulnerabilities/id/2b45674c-8446-44eb-a45a-15dab02c89cf?source=cve

Summary

Description

References