CVE-2021-42362

Katalog CVE

CVSS 8.8 · High EPSS 79,8%

Kerentanan Unrestricted Upload of File with Dangerous Type pada wordpress popular posts project wordpress popular posts. Skor CVSS 3.1 8.8 (High) menurut wordfence.com.

Deskripsi (NVD)

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.

Rincian

Terbit di NVD

17 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

79,8% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/changeset/2542638/wordpress-popular-posts/trunk/src/Image.php patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/165376/WordPress-Popular-Posts-5.3.2-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/ exploit · advisory pihak ketiga
• https://wpscan.com/vulnerability/bd4f157c-a3d7-4535-a587-0102ba4e3009 advisory pihak ketiga
• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42362 advisory pihak ketiga
• https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb446e4103cb18f69897ec6fe601