Vulnerability · Published Mar 28, 2022 · Assigned by WPScan
CVE-2021-24962WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE
High 8.8
In plain English
A high-severity path traversal in WordPress File Upload from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)2.8%top 13.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WordPress File Upload | 4.16.3 – before 4.16.3 |
| Unknown | WordPress File Upload Pro | 4.16.3 – before 4.16.3 |
Weakness: CWE-22
References
- https://plugins.trac.wordpress.org/changeset/2677722 x_refsource_CONFIRM
- https://wpscan.com/vulnerability/7a95b3f2-285e-40e3-aead-41932c207623 x_refsource_MISC