CVE-2021-24222

WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE

State: Published
Severity: Not scored
Published: Apr 12, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.

Scores

The record has no CVSS score.

Weaknesses

CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
WP-Curriculo Vitae FreeUnknown	6.3 through 6.3Affected

References

https://wpscan.com/vulnerability/4d715de6-8595-4da9-808a-04a28e409900
https://github.com/jinhuang1102/CVE-ID-Reports/blob/145fc4e34c9b9799275c8e19d6b02f544c88126b/WP_Curriculo_Free.md

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.