CVE-2024-1205 is a high severity arbitrary file upload flaw in the Management App for WooCommerce plugin for WordPress, also known as WeManage. Versions up to and including 1.2.2 are affected and the score is 8.8. A subscriber level account is enough. Update the plugin and audit your uploads folder.
What's affected
The record covers all versions of the Management App for WooCommerce plugin up to and including 1.2.2. The faulty code is the nouvello_upload_csv_file function, which does not validate the type of the file it accepts.
The attacker needs only subscriber level access or above. Because the plugin does not check file types, an authenticated user can place arbitrary files on the web server. The record says this may make remote code execution possible.
The record does not give a fixed version. It references two WordPress Trac changesets for the wemanage-app-worker plugin and a Wordfence entry, which I could not retrieve. Check the plugin changelog or the Wordfence entry for the patched release number.
Weakness class: CWE-434. The NVD record carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and a score of 8.8.
How to check if you're exposed
The plugin slug in the record's source links is wemanage-app-worker. With WP-CLI:
wp plugin list --fields=name,version,status | grep -i wemanage
Without shell access, read the version in the Plugins screen of the admin. 1.2.2 or lower is in range.
Then look for signs of misuse. List recently modified files under wp-content/uploads and look for script files such as PHP, which have no business being there.
find wp-content/uploads -type f -name '*.php' -mtime -90
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in your own projects, and reachability analysis helps you tell which findings your code actually calls.
What to do now
- Update the plugin to the latest version, or remove it if you do not use its order and uptime features.
- Confirm the installed version is newer than 1.2.2.
- Search the uploads directory for script files and unexpected CSV or other uploads, and keep copies for review before deleting anything.
- Disable script execution in the uploads directory at the web server level if you have not already.
- Review subscriber accounts and reset passwords for any that look suspicious.
Why it matters
Unrestricted upload is CWE-434. A function that is meant to take a CSV file should verify the extension and content, store it somewhere that cannot execute code, and rename it. When it does none of that, an uploaded script can be requested over the web and run with the web server's privileges.
The privilege requirement is the interesting part. Subscriber is the lowest WordPress role and many sites grant it to every customer. CVSS counts low privileges, which is why the score is 8.8 and not lower. The KEV flag in the record is false, and I found no advisory that reports exploitation.
Quick check
What is the safest quick fix?
Update the plugin past 1.2.2. If you cannot update today, deactivate it, since the weak function is part of the plugin itself.
Does blocking PHP in uploads fully fix this?
It limits the worst outcome but does not replace the update. The plugin would still accept files it should refuse.
Sources
Last reviewed: 19 October 2026.
