CVE-2021-24962: iptanus wordpress file upload +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2021-24962

CVSS 8.8 · High EPSS 2,8%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada iptanus wordpress file upload, iptanus wordpress file upload pro. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution.

Rincian

Terbit di NVD: 28 Maret 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 2,8% peluang dieksploitasi; lebih tinggi dari 86,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
iptanus	wordpress file upload	Semua versi sebelum 4.16.3
iptanus	wordpress file upload pro	Semua versi sebelum 4.16.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://plugins.trac.wordpress.org/changeset/2677722 patch · advisory pihak ketiga
https://wpscan.com/vulnerability/7a95b3f2-285e-40e3-aead-41932c207623 exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.