CVE-2021-24966

CVE-2021-24966: Error Log Viewer Plugin <= 1.1.1 - Admin+ Arbitrary File Clearing

Vendor Unknown

Product Error Log Viewer by BestWebSoft

Weakness CWE-73

Published March 14, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder

Key dates

02Disclosure timeline

March 14, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-24966 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/73.html AskarLabs — CWE-73 write-up External Control of File Name or Path

Related vulnerabilities

04Related CVE

CVE-2025-3431 ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated Arbitrary File Download CVE-2026-6101 AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload CVE-2025-10494 Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2024-10672 Multiple Page Generator Plugin – MPG <= 4.0.2 - Authenticated (Editor+) Directory Traversal to Limited File Deletion CVE-2022-0593 Login with phone number < 1.3.7 - Unauthenticated remote plugin deletion