Vulnerability Details : CVE-2021-42362

Public exploit exists!
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.
Published 2021-11-17 18:15:08
Updated 2024-09-16 19:16:00
Source Wordfence
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2021-42362

Exploit prediction scoring system (EPSS) score for CVE-2021-42362

EPSS FAQ
84.50%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2021-42362

  • Wordpress Popular Posts Authenticated RCE
    Disclosure Date: 2021-06-11
    First seen: 2022-12-23
    exploit/multi/http/wp_popular_posts_rce
    This exploit requires Metasploit to have a FQDN and the ability to run a payload web server on port 80, 443, or 8080. The FQDN must also not resolve to a reserved address (192/172/127/10). The server must also respond to a HEAD request for the payload, prior to gettin

CVSS scores for CVE-2021-42362

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
6.5
 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P
8.0
6.4
 NIST
8.8
 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
 Wordfence

CWE ids for CVE-2021-42362

References for CVE-2021-42362

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close