{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1702d3d4fd0fae9cb9fc40cdfc3dfb8584d5f04c"
            }
          ],
          "repo": "https://github.com/tumult/hype-wordpress-plugin",
          "type": "GIT"
        }
      ]
    }
  ],
  "details": "The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations_panel() function in all versions up to, and including, 1.9.15. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.",
  "id": "CVE-2024-11082",
  "modified": "2026-03-15T21:44:59.187854927Z",
  "published": "2024-11-28T10:15:05.973Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/tumult-hype-animations/trunk/includes/adminpanel.php#L277"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3197761/"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/tumult-hype-animations/#developers"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/be3a0b4b-cce5-4d78-99d5-697f2cf04427?source=cve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/tumult/hype-wordpress-plugin/commit/1702d3d4fd0fae9cb9fc40cdfc3dfb8584d5f04c"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}