CVE Vulnerability

CVE-2021-24252

The Event Banner WordPress plugin through 1.3 does not verify the uploaded image file, allowing admin accounts to upload arbitrary files, such as .exe, .php, or others executable, leading to RCE. Due to the lack of CSRF check, the issue can also be used via such vector to achieve the same result, or via a LFI as authorisation checks are missing (but would require WP to be loaded)

6.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

7.2 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/Event%20Banner.md Broken Link
https://wpscan.com/vulnerability/91e81c6d-f24d-4f87-bc13-746715af8f7c Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:wp-eventmanager:event_banner:*:*:*:*:*:wordpress:*:*
Information

Published : 2021-05-06 01:15

Updated : 2022-10-25 07:26

NVD link : CVE-2021-24252

Mitre link : CVE-2021-24252

Products Affected
No products.
CWE
CWE-434