Vulnerability · Published Dec 21, 2021 · Assigned by WPScan
CVE-2021-24981Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload
High 7.5
In plain English
A high-severity unrestricted file upload in Directorist – Business Directory Plugin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)0.8%top 42.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Directorist – Business Directory Plugin | 7.0.6.2 – before 7.0.6.2 |
Weakness: CWE-434, CWE-352