Riskcovery

CVE-2021-4096

Fancy Product Designer <= 4.7.5 - Cross-Site Request Forgery to Arbitrary File Upload

State
Published
Severity
8.8 High
Published
Apr 19, 2022
Updated
Feb 7, 2025
Reserved
Dec 10, 2021

Read the record on cve.org

Description

The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWordfence

Weaknesses

  • CWE-352 Cross-Site Request Forgery (CSRF)
  • CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

ProductVersions
Fancy Product Designerfancy-product-designer
  • 4.7.5 through 4.7.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.