CVE-2021-34624

ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component

A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3. .

Affected

ProfilePress

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

6.74% chance of exploitation in the next 30 days, 94th percentile

Nuclei

critical · CWE-434

Published

2021-07-07

Updated

2024-10-15

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34624.yaml

Security advisories

• https://www.wordfence.com/blog/2021/06/easily-exploitable-critical-vulnerabilities-patche…

References

• CVE Record
• NVD entry