CVE-2021-24757 Stylish Price List < 6.9.0 - Unauthenticated Arbitrary Image Upload
Unauthenticated attackers can upload arbitrary images due to missing capability checks in the Stylish Price List WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24757?
CVE-2021-24757 is a medium-severity vulnerability in Unknown Stylish Price List, published on 1 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.
Weakness: CWE-863
Which versions are affected by CVE-2021-24757?
It affects 1 product.
Products include Stylishpricelist Stylish Price List.
How do I fix CVE-2021-24757?
No fix has been published for CVE-2021-24757 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24757 being exploited?
There is no known exploitation of CVE-2021-24757 in the wild and no public exploit code.
Other vulnerabilities in Unknown Stylish Price List
- CVE-2021-24770 Stylish Price List < 6.9.1 - Subscriber+ Arbitrary Image Upload
- CVE-2024-10472 Stylish Price List < 7.1.12 - Contributor+ Stored XSS
- CVE-2023-51673 WordPress Stylish Price List Plugin <= 7.0.17 is vulnerable to Broken Access Control
- CVE-2024-7758 Stylish Price List < 7.1.8 - Contributor+ Stored XSS
Sources
Also known as GHSA-gv86-wf87-753x.