Vulnerability Details CVE-2021-24253
The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.011
EPSS Ranking 77.4%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 6.5
References
Products affected by CVE-2021-24253
-
cpe:2.3:a:classyfrieds_project:classyfrieds:-
-
cpe:2.3:a:classyfrieds_project:classyfrieds:3.3
-
cpe:2.3:a:classyfrieds_project:classyfrieds:3.5
-
cpe:2.3:a:classyfrieds_project:classyfrieds:3.6
-
cpe:2.3:a:classyfrieds_project:classyfrieds:3.7
-
cpe:2.3:a:classyfrieds_project:classyfrieds:3.8