CVE-2021-4455 CRITICAL

CVE-2021-4455: Wordpress Plugin Smart Product Review <= 1.0.4 - Unauthenticated Arbitrary File Upload

Vendor Codeflist
Product Wordpress Plugin Smart Product Review
Weakness CWE-434 · Unrestricted file upload
Published April 19, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Explanation of Vulnerability in Simple Terms

02Summary

The Smart Product Review WordPress plugin through version 1.0.4 does not properly validate or restrict file uploads. An unauthenticated attacker can upload arbitrary files to the site, including PHP scripts, allowing them to run their own code on the server. This affects all installations of the plugin without a patch applied.

What an attacker can do

03Attacker Capabilities

Upload and execute arbitrary files, including PHP code, on the site without authentication.

Potential impact on your site

04Site Impact

Complete compromise of the WordPress site; attacker can read/modify/delete data and take full control.

Conditions required to exploit

05Prerequisites

Network access to the WordPress site; no authentication or user interaction required.

Key dates

06Disclosure timeline

April 19, 2025 CVE published
April 8, 2026 Record updated