CVE-2021-24757CWE-863

Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image Upload

published November 1, 2021

CVSS
—
EPSS
1%
Percentile
64.1
In the wild
Unconfirmed
What it is

The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01054 · 64.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2021-11-01T08:46Z
EPSS history
Timeline
  • 01 NOV 08:46Z
    Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image Upload
    cvelistv5