Lucene search
Jin HuangWPVDB-ID:BB3E56DD-AE2E-45C2-A6C9-A59AE5FC1DC4HistoryApr 11, 2021 - 12:00 a.m.
College Publisher Import <= 0.1 - Arbitrary File Upload to RCE
2021-04-1100:00:00
Jin Huang
wpscan.com
5
0.001 Low
EPSS
Percentile
44.7%
The plugin does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack. The issue has been escalated to WordPress on April 12th, 2021
PoC
The PoC will be displayed once the issue has been remediated
| CPE | Name | Operator | Version |
|---|---|---|---|
| college-publisher-import | eq | * |
Related
cnvd
cnvd
WordPress College publisher Import plugin file upload vulnerability
2021-05-07 00:00:00
prion
prion
Cross site request forgery (csrf)
2021-05-06 13:15:00
nvd
nvd
CVE-2021-24254
2021-05-06 13:15:11
wpexploit
wpexploit
College Publisher Import <= 0.1 - Arbitrary File Upload to RCE
2021-04-11 00:00:00
cve
cve
CVE-2021-24254
2021-05-06 13:15:11
cvelist
cvelist
patchstack
patchstack