CVE-2021-24224
Assigner: WPScan
Published: 2021-04-12T14:04:08
State: PUBLISHED
affected: product: Easy Form Builder
vendor: Unknown
versions: lessThanOrEqual: 1.0
status: affected
version: 1.0
versionType: custom
credits: value: Jin Huang
descriptions: value: The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
problemTypes: descriptions: cweId: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
type: CWE
source: discovery: UNKNOWN
title: Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload
x_generator: WPScan CVE Generator