CVE-2021-24253CWE-434

Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE

published May 5, 2021

CVSS
—
EPSS
2%
Percentile
79.6
In the wild
Unconfirmed
What it is

The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01906 · 79.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2021-05-05T18:39Z
EPSS history
Timeline
  • 05 MAY 18:39Z
    Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE
    cvelistv5