Vulnerability · Published Apr 12, 2021 · Assigned by WPScan
CVE-2021-24222WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE
Critical 9.8
In plain English
A critical-severity unrestricted file upload in WP-Curriculo Vitae Free from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)2.4%top 15.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP-Curriculo Vitae Free | 6.3 – through 6.3 |
Weakness: CWE-434