CVE-2021-24254CWE-434

College Publisher Import <= 0.1 - Arbitrary File Upload to RCE

published May 5, 2021

CVSS
—
EPSS
2%
Percentile
78.9
In the wild
Unconfirmed
What it is

The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01844 · 78.9th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2021-05-05T18:39Z
EPSS history
Timeline
  • 05 MAY 18:39Z
    College Publisher Import <= 0.1 - Arbitrary File Upload to RCE
    cvelistv5