CVE-2021-24254 College Publisher Import <= 0.1 - Arbitrary File Upload to RCE
High-privilege users can upload arbitrary PHP files via CSV import, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24254?
CVE-2021-24254 is a high-severity vulnerability in Unknown College publisher Import, published on 5 May 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.
Weakness: CWE-434
Which versions are affected by CVE-2021-24254?
It affects 1 product.
Products include College Publisher Import Project College Publisher Import.
How do I fix CVE-2021-24254?
No fix has been published for CVE-2021-24254 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24254 being exploited?
There is no known exploitation of CVE-2021-24254 in the wild and no public exploit code.
Sources
Also known as GHSA-xmhj-gj46-9j4f.