CVE-2021-24179CWE-352

Business Directory Plugin < 5.11 - Arbitrary File Upload to RCE

published May 5, 2021

CVSS
—
EPSS
1%
Percentile
51.5
In the wild
Unconfirmed
What it is

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00672 · 51.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-05-05T18:39Z
EPSS history
Timeline
  • 05 MAY 18:39Z
    Business Directory Plugin < 5.11 - Arbitrary File Upload to RCE
    cvelistv5