CVE-2021-24721 Loco Translate < 2.5.4 - Authenticated PHP Code Injection
Authenticated translator users can inject PHP code into web-accessible files, leading to remote code execution on the WordPress site.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24721?
CVE-2021-24721 is a medium-severity code injection vulnerability in Unknown Loco Translate, published on 8 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.
Weakness: CWE-94
Which versions are affected by CVE-2021-24721?
It affects 1 product.
Products include Loco Translate Project Loco Translate.
How do I fix CVE-2021-24721?
No fix has been published for CVE-2021-24721 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-24721 being exploited?
There is no known exploitation of CVE-2021-24721 in the wild and no public exploit code.
Other vulnerabilities in Unknown Loco Translate
Sources
Also known as GHSA-8mj6-23hc-v88f.