CVE-2021-24284
Kaswara Modern VC Addons <= 3.0.1 - Unauthenticated Arbitrary File Upload
The Kaswara Modern VC Addons WordPress plugin through 3.0.1 allows unauthenticated arbitrary file upload via the 'uploadFontIcon' AJAX action. The supplied zipfile being unzipped in the wp-content/uploads/kaswara/fonts_icon directory with no checks for malicious files such as PHP.
Productos afectados
SayenThemes · Kaswara Modern VC Addons¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →