CVE-2021-24981CWE-352CWE-434

Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload

published December 21, 2021

CVSS
—
EPSS
1%
Percentile
57.4
In the wild
Unconfirmed
What it is

The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00837 · 57.4th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2021-12-21T08:45Z
EPSS history
Timeline
  • 21 DEC 08:45Z
    Directorist – Business Directory Plugin < 7.0.6.2 - CSRF to Remote File Upload
    cvelistv5