CVE-2021-42362 WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload
Authenticated attackers with contributor access can upload malicious files to achieve remote code execution in the WordPress Popular Posts plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-42362?
CVE-2021-42362 is a high-severity vulnerability in WordPress Popular Posts, published on 17 Nov 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.
Weakness: CWE-434
Which versions are affected by CVE-2021-42362?
It affects 1 product.
Products include Wordpress Popular Posts Project Wordpress Popular Posts.
How do I fix CVE-2021-42362?
No fix has been published for CVE-2021-42362 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-42362 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-42362 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in WordPress Popular Posts
- CVE-2022-43468 Business logic in WordPress Popular Posts
- CVE-2023-45607 WordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2021-36872 WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
- CVE-2021-20746 Cross-site scripting in WordPress Popular Posts
Sources
Also known as GHSA-p9wv-phc4-8hqf.