CVE-2021-24962: vulnerability in WordPress File Upload
WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 2.8%
The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution.
Related CVEs — WordPress File Upload
In the same product, most dangerous first.
CVE-2024-6651MEDIUMWordPress File Upload < 4.24.8 - Reflected XSSEPSS 15.7%CVE-2023-2688MEDIUMWordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path TraversalEPSS 1.7%CVE-2021-24961—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2021-24960—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVGEPSS 0.7%CVE-2023-4811MEDIUMWordPress File Upload < 4.23.3 - Author+ Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-2767MEDIUMWordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%