CVE-2021-24240: Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE

Q: Who can exploit this issue?

A remote attacker does not need authentication or user interaction. Any reachable site running the affected plugin version through 5.5.0 is exposed to attempted exploitation.

Q: What is the impact if exploitation succeeds?

An attacker can upload arbitrary files through the plugin's manual update functionality and use that capability to achieve remote code execution. This can affect confidentiality, integrity, and availability.

Q: Which plugin functionality is involved?

The vulnerable path is the manual update functionality. Sites using Business Hours Pro through version 5.5.0 should treat that functionality as an exposure point.

Published Apr 22, 2021

Updated

The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.

Affected Software

1 affected component

Aivahthemes Business Hours Pro Wordpress<=5.5.0

Event History

Apr 22, 2021

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote attacker does not need authentication or user interaction. Any reachable site running the affected plugin version through 5.5.0 is exposed to attempted exploitation.

What is the impact if exploitation succeeds?

An attacker can upload arbitrary files through the plugin's manual update functionality and use that capability to achieve remote code execution. This can affect confidentiality, integrity, and availability.

Which plugin functionality is involved?

The vulnerable path is the manual update functionality. Sites using Business Hours Pro through version 5.5.0 should treat that functionality as an exposure point.

CVE-2021-24240: Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact if exploitation succeeds?

Which plugin functionality is involved?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact if exploitation succeeds?

Which plugin functionality is involved?