VULNERABILITY INTELLIGENCE

CVE-2021-24123

CVSS score7.2 HIGH
EPSS probability1.65%
CISA KEVNot currently listed
Published2021-03-18
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Arbitrary file upload in the PowerPress WordPress plugin, versions before 8.3.8, did not verify some of the uploaded feed images (such as the ones from Podcast Artwork section), allowing high privilege accounts (admin+) being able to upload arbitrary files, such as php, leading to RCE.

Weakness classification

  • contact@wpscan.com: CWE-434
  • nvd@nist.gov: CWE-434

Primary references