The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/4fb90999-6f91-4200-a0cc-bfe9b34a5de9 | Exploit Third Party Advisory |
https://www.wordfence.com/blog/2021/05/critical-vulnerability-patched-in-external-media-plugin/ | Exploit Third Party Advisory |
https://wpscan.com/vulnerability/4fb90999-6f91-4200-a0cc-bfe9b34a5de9 | Exploit Third Party Advisory |
https://www.wordfence.com/blog/2021/05/critical-vulnerability-patched-in-external-media-plugin/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 05:52
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/4fb90999-6f91-4200-a0cc-bfe9b34a5de9 - Exploit, Third Party Advisory | |
References | () https://www.wordfence.com/blog/2021/05/critical-vulnerability-patched-in-external-media-plugin/ - Exploit, Third Party Advisory |
09 Jun 2021, 00:47
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-434 | |
CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
CPE | cpe:2.3:a:external_media_project:external_media:*:*:*:*:*:wordpress:*:* | |
References | (MISC) https://www.wordfence.com/blog/2021/05/critical-vulnerability-patched-in-external-media-plugin/ - Exploit, Third Party Advisory | |
References | (CONFIRM) https://wpscan.com/vulnerability/4fb90999-6f91-4200-a0cc-bfe9b34a5de9 - Exploit, Third Party Advisory |
01 Jun 2021, 14:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-06-01 14:15
Updated : 2024-11-21 05:52
NVD link : CVE-2021-24311
Mitre link : CVE-2021-24311
CVE.ORG link : CVE-2021-24311
JSON object : View
Products Affected
external_media_project
- external_media
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type