Vulnerabilities > CVE-2021-24253 - Unspecified vulnerability in Classyfrieds Project Classyfrieds
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 6 |