CVE-2021-4096CWE-352CWE-434

Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload

High · published April 19, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00596 · 47.8th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-04-19T20:26Z
EPSS history
Timeline
  • 19 APR 20:26Z
    Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload
    cvelistv5