CVE-2021-24962: fallo en WordPress File Upload
WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 2.8%
The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution.
CVEs relacionadas — WordPress File Upload
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-6651MEDIUMWordPress File Upload < 4.24.8 - Reflected XSSEPSS 15.7%CVE-2023-2688MEDIUMWordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path TraversalEPSS 1.7%CVE-2021-24961—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via ShortcodeEPSS 0.7%CVE-2021-24960—WordPress File Upload < 4.16.3 - Contributor+ Stored Cross-Site Scripting via Malicious SVGEPSS 0.7%CVE-2023-4811MEDIUMWordPress File Upload < 4.23.3 - Author+ Stored Cross-Site ScriptingEPSS 0.5%CVE-2023-2767MEDIUMWordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.4%