CVE-2021-24248CWE-434

Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCE

published May 5, 2021

CVSS
—
EPSS
2%
Percentile
75.4
In the wild
Unconfirmed
What it is

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01583 · 75.4th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2021-05-05T18:39Z
EPSS history
Timeline
  • 05 MAY 18:39Z
    Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCE
    cvelistv5