Vulnerability Description
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Wordpress Popular Posts Project | Wordpress Popular Posts | <= 5.3.2 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/165376/WordPress-Popular-Posts-5.3.2-RemoteExploitThird Party AdvisoryVDB Entry
- https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popularExploitThird Party Advisory
- https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb44
- https://plugins.trac.wordpress.org/changeset/2542638/wordpress-popular-posts/truPatchThird Party Advisory
- https://wpscan.com/vulnerability/bd4f157c-a3d7-4535-a587-0102ba4e3009Third Party Advisory
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42362Third Party Advisory
- http://packetstormsecurity.com/files/165376/WordPress-Popular-Posts-5.3.2-RemoteExploitThird Party AdvisoryVDB Entry
- https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popularExploitThird Party Advisory
- https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb44
- https://plugins.trac.wordpress.org/changeset/2542638/wordpress-popular-posts/truPatchThird Party Advisory
- https://wpscan.com/vulnerability/bd4f157c-a3d7-4535-a587-0102ba4e3009Third Party Advisory
- https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42362Third Party Advisory
FAQ
What is CVE-2021-42362?
CVE-2021-42362 is a vulnerability with a CVSS score of 8.8 (HIGH). The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attack...
How severe is CVE-2021-42362?
CVE-2021-42362 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-42362?
Check the references section above for vendor advisories and patch information. Affected products include: Wordpress Popular Posts Project Wordpress Popular Posts.