CVE-2021-4096: Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload
The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPDAdminImport class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the vulnerability ID of the Fancy Product Designer plugin for WordPress vulnerability?
The vulnerability ID of the Fancy Product Designer plugin for WordPress vulnerability is CVE-2021-4096.
What is the severity level of CVE-2021-4096?
CVE-2021-4096 has a severity level of 8.8 (High).
How does the Fancy Product Designer plugin for WordPress vulnerability affect the software?
The vulnerability in the Fancy Product Designer plugin for WordPress allows attackers to perform Cross-Site Request Forgery and upload malicious files, potentially gaining webshell access to a server.
What versions of the Fancy Product Designer plugin for WordPress are affected by CVE-2021-4096?
Versions up to and including 4.7.5 of the Fancy Product Designer plugin for WordPress are affected by CVE-2021-4096.
How can I learn more about CVE-2021-4096 Fancy Product Designer plugin for WordPress vulnerability?
You can find more information about CVE-2021-4096 Fancy Product Designer plugin for WordPress vulnerability in the following references: [Reference 1](https://support.fancyproductdesigner.com/support/discussions/topics/13000031615) and [Reference 2](https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096).