CVE-2021-24962

CVE-2021-24962: WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE

Vendor Unknown
Product WordPress File Upload
Weakness CWE-22 · Path traversal
Published March 28, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution.

Key dates

02Disclosure timeline

March 28, 2022 CVE published
August 3, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-60027 Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 CVE-2026-15979 Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion CVE-2026-61980 WordPress OMGF Pro plugin <= 5.2.7 - Arbitrary File Download vulnerability CVE-2026-5114 SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read CVE-2026-28146 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability