CVE-2021-25053

CVE-2021-25053: WP Coder < 2.5.2 - RFI leading to RCE via CSRF

Vendor Unknown
Product WP Coder – add custom html, css and js code
Weakness CWE-352 · CSRF
Published January 10, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

Key dates

02Disclosure timeline

January 10, 2022 CVE published
August 3, 2024 Record updated