CVE-2021-24253

Published: May 6, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.

Affected (1)

Products: Classyfrieds Project: Classyfrieds

Classyfrieds Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Classyfrieds Project Classyfrieds	Up to 3.8

Related CWEs

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/classyfrieds.md

Source: contact@wpscan.com

ExploitThird Party Advisory

https://wpscan.com/vulnerability/ee42c233-0ff6-4b27-a5ec-ad3246bef079

Source: contact@wpscan.com

ExploitThird Party Advisory

https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/classyfrieds.md

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://wpscan.com/vulnerability/ee42c233-0ff6-4b27-a5ec-ad3246bef079

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.