CVE-2021-24123CWE-434

PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE

published March 18, 2021

CVSS
—
EPSS
2%
Percentile
76.3
In the wild
Unconfirmed
What it is

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), allowing high privilege accounts (admin+) being able to upload arbitrary files, such as php, leading to RCE.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01647 · 76.3th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2021-03-18T14:57Z
EPSS history
Timeline
  • 18 MAR 14:57Z
    PowerPress < 8.3.8 - Authenticated Arbitrary File Upload leading to RCE
    cvelistv5