CVEvulnerability
CVE-2021-24254
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-05-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-434
Description
The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.
Affected configurations
• college publisher import project college publisher import (<= 0.1)
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/College%20Puglisher%20Import.md Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/bb3e56dd-ae2e-45c2-a6c9-a59ae5fc1dc4 Exploit, Third Party Advisory
- https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/College%20Puglisher%20Import.md Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/bb3e56dd-ae2e-45c2-a6c9-a59ae5fc1dc4 Exploit, Third Party Advisory