CVE-2021-24284: vulnerability in SayenThemes Kaswara Modern VC Addons
Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload
Published · Updated
52Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 42%
from disclosure to weapon
Published on NVDMay 14
VulnCheck+954d
exploitation probability
42%top 1% of all CVEs
observed exploitation
yesVulnCheck
The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
Affected products
SayenThemes · Kaswara Modern VC AddonsRelated CVEs — SayenThemes Kaswara Modern VC Addons
In the same product, most dangerous first.