CVE-2021-24890CWE-352CWE-862

Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload

High · published September 26, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
47.1
In the wild
Unconfirmed
What it is

The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00583 · 47.1th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-862 · Missing Authorization
Published
2022-09-26T12:35Z
EPSS history
Timeline
  • 26 SEP 12:35Z
    Scripts Organizer < 3.0 - Unauthenticated Arbitrary File Upload
    cvelistv5