1. Home
  2. CVE Database
  3. CVE-2021-25004
MEDIUM · 4.9

CVE-2021-25004

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server wit...

Vulnerability Description

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.

CVSS Score

4.9

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Seur Oficial ProjectSeur Oficial< 1.7.2

Related Weaknesses (CWE)

CWE-552

References

FAQ

What is CVE-2021-25004?

CVE-2021-25004 is a vulnerability with a CVSS score of 4.9 (MEDIUM). The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server wit...

How severe is CVE-2021-25004?

CVE-2021-25004 has been rated MEDIUM with a CVSS base score of 4.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-25004?

Check the references section above for vendor advisories and patch information. Affected products include: Seur Oficial Project Seur Oficial.