CVE-2021-24248 Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCE

Q: What is CVE-2021-24248?

CVE-2021-24248 is a high-severity vulnerability in Business Directory Plugin – Easy Listing Directories for WordPress, published on 5 May 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Q: Is CVE-2021-24248 being exploited?

There is no known exploitation of CVE-2021-24248 in the wild and no public exploit code.

Q: How do I fix CVE-2021-24248?

No fix has been published for CVE-2021-24248 yet. Limit exposure of the affected software until one is available.

High 7.2 Published 5 May 2021 Updated 3 Aug 2024

Administrators can upload malicious PHP4 files via import features, leading to remote code execution on the WordPress site.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-24248?

CVE-2021-24248 is a high-severity vulnerability in Business Directory Plugin – Easy Listing Directories for WordPress, published on 5 May 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE

Weakness: CWE-434

Which versions are affected by CVE-2021-24248?

It affects 1 product.

Products include Strategy11 Business Directory Plugin - Easy Listing Directories.

How do I fix CVE-2021-24248?

No fix has been published for CVE-2021-24248 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-24248 being exploited?

There is no known exploitation of CVE-2021-24248 in the wild and no public exploit code.

Sources

Also known as GHSA-954q-pwww-w7g3.