CVE-2021-24370 Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE
Unauthenticated attackers can upload arbitrary files to the Fancy Product Designer WordPress plugin, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24370?
CVE-2021-24370 is a critical vulnerability in Unknown Fancy Product Designer, published on 21 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
Weakness: CWE-434
Which versions are affected by CVE-2021-24370?
It affects 1 product.
Products include Radykal Fancy Product Designer.
How do I fix CVE-2021-24370?
No fix has been published for CVE-2021-24370 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24370 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24370 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Unknown Fancy Product Designer
- CVE-2021-4334 Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options
- CVE-2021-4096 Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload
- CVE-2021-4134 Fancy Product Designer <= 4.7.4 Admin+ SQL Injection
- CVE-2024-0365 Fancy Product Designer < 6.1.5 - Admin+ SQL Injection
- CVE-2024-0905 Fancy Product Designer < 6.1.8 - Reflected Cross Site Scripting
Sources
Also known as GHSA-x5g3-h6vq-mcw4.