CVE-2021-24770CWE-863

Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload

published November 1, 2021

CVSS
—
EPSS
1%
Percentile
57.8
In the wild
Unconfirmed
What it is

The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users), which could allow any authenticated users, such as subscriber, to upload arbitrary images.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00852 · 57.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2021-11-01T08:46Z
EPSS history
Timeline
  • 01 NOV 08:46Z
    Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload
    cvelistv5