CVE-2021-24639CWE-22CWE-352CWE-862

OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion

published September 20, 2021

CVSS
—
EPSS
1%
Percentile
59.7
In the wild
Unconfirmed
What it is

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00912 · 59.7th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2021-09-20T10:06Z
EPSS history
Timeline
  • 20 SEP 10:06Z
    OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
    cvelistv5