CVE-2024-10938 - CVE House
Back to Database
Status published Medium CVE-2024-10938

OVRI Payment 1.7.0 - Malicious .htaccess directive

Vulnerability Description

The OVRI Payment plugin for WordPress contains malicious .htaccess files in version 1.7.0. The files contain directives to prevent the execution of certain scripts while allowing execution of known malicious PHP files. If moved outside of the plugin's directory, they may interfere with the proper function of a site.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-10938

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Marco Wotschka

References

Affected Vendor

Affected Software

OVRI Payment
Vulnerable Versions:
1.7.0

Timeline

Official Publish: February 27th, 2026
Last Modified: February 27th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weaknesses (CWE)

CWE-506

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.