CVE-2021-25051

The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include() arbitrary file with PHP extension (as well as with data:// or http:// protocols), thus leading to CSRF RCE.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P

EPSS

0.77% chance of exploitation in the next 30 days, 53th percentile

Published

2022-01-10

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/566ff8dc-f820-412b-b2d3-fa789bce528e

References

• CVE Record
• NVD entry

Related

• CVE-2021-25050
• CVE-2021-25052
• CVE-2021-25049
• CVE-2021-25053
• CVE-2021-25048
• CVE-2021-25054