CVE-2021-24370observed exploitationCWE-434

CVE-2021-24370: vulnerability in Fancy Product Designer

Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE

Published 21 Jun 2021 · Updated 03 Aug 2024

Follow this CVE + Monitor Fancy Product Designer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

52Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 47%

from disclosure to weapon

Published on NVDJun 21

VulnCheckJun 1

The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.

Affected products

Unknown · Fancy Product Designer

Related CVEs — Fancy Product Designer

In the same product, most dangerous first.

CVE-2024-0365MEDIUMFancy Product Designer < 6.1.5 - Admin+ SQL InjectionEPSS 0.6%CVE-2024-0904MEDIUMFancy Product Designer < 6.1.81 - Admin+ Cross Site ScriptingEPSS 0.6%CVE-2024-0905MEDIUMFancy Product Designer < 6.1.8 - Reflected Cross Site ScriptingEPSS 0.5%CVE-2024-0902MEDIUMFancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product TitleEPSS 0.4%

References

https://lists.openwall.net/full-disclosure/2020/11/17/2 https://seclists.org/fulldisclosure/2020/Nov/30 https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38 https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/