CVEvulnerability
CVE-2021-4382
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-06-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-434
Description
The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() function in versions up to, and including, 3.0.4. This makes it possible for authenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected configurations
• recently project recently (< 3.0.5)
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://plugins.trac.wordpress.org/changeset/2542693 Release Notes
- https://wpscan.com/vulnerability/92c3f26a-1a84-459a-874b-07dc83c9f42a Third Party Advisory
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-recently-multiple-vulnerabilities-3-0-4/ Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f8297149-2de3-4e49-80f9-6ea59dea6bce?source=cve Third Party Advisory
- https://plugins.trac.wordpress.org/changeset/2542693 Release Notes
- https://wpscan.com/vulnerability/92c3f26a-1a84-459a-874b-07dc83c9f42a Third Party Advisory
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-recently-multiple-vulnerabilities-3-0-4/ Third Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f8297149-2de3-4e49-80f9-6ea59dea6bce?source=cve Third Party Advisory