CVE-2021-4096 Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload
Attackers can upload malicious files via CSRF to gain webshell access on servers using the Fancy Product Designer WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-4096?
CVE-2021-4096 is a high-severity vulnerability in fancy-product-designer Fancy Product Designer, published on 19 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.
Which versions are affected by CVE-2021-4096?
It affects 1 product.
Products include Radykal Fancy Product Designer.
How do I fix CVE-2021-4096?
No fix has been published for CVE-2021-4096 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-4096 being exploited?
There is no known exploitation of CVE-2021-4096 in the wild and no public exploit code.
Other vulnerabilities in fancy-product-designer Fancy Product Designer
- CVE-2021-24370 Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE
- CVE-2021-4334 Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_options
- CVE-2021-4134 Fancy Product Designer <= 4.7.4 Admin+ SQL Injection
- CVE-2024-0365 Fancy Product Designer < 6.1.5 - Admin+ SQL Injection
- CVE-2024-0905 Fancy Product Designer < 6.1.8 - Reflected Cross Site Scripting
Sources
Also known as GHSA-h292-vmfp-f8m3.