VULNERABILITY INTELLIGENCE

CVE-2021-24639

CVSS score8.1 HIGH

EPSS probability0.91%

CISA KEVNot currently listed

Published2021-09-20

Last modified2026-06-17

Description

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.