CVE-2021-24179: Business Directory Plugin < 5.11 - Arbitrary File Upload to RCE
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE.
Other sources
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24179?
CVE-2021-24179 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2021-24179?
To fix CVE-2021-24179, update the Business Directory Plugin to version 5.11 or later.
What types of attacks can CVE-2021-24179 facilitate?
CVE-2021-24179 can facilitate Cross-Site Request Forgery attacks and exploit file upload vulnerabilities leading to remote code execution.
Who is affected by CVE-2021-24179?
Anyone using the Business Directory Plugin - Easy Listing Directories for WordPress versions before 5.11 is affected by CVE-2021-24179.
What should I do if I cannot update to fix CVE-2021-24179?
If you cannot update to fix CVE-2021-24179, you should disable the plugin and seek alternative solutions or plugins.