CVE-2021-24212observed exploitationCWE-434

CVE-2021-24212: vulnerability in WooCommerce Help Scout

WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE

Published · Updated

Follow this CVE+ Monitor Help Scout

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

40Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 7.9%
from disclosure to weapon
Published on NVDApr 5
VulnCheckMar 21
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp.
Affected products
Unknown · WooCommerce Help Scout