CVE-2021-24252

🗓️ 05 May 2021 18:39:43Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 40 Views🌐 WEB

The Event Banner WordPress plugin through 1.3 allows admin accounts to upload arbitrary files and achieve Remote Code Execution (RCE) due to lack of file verification and CSRF check

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress 代码问题漏洞	6 May 202100:00	–	cnnvd
Cvelist	CVE-2021-24252 Event Banner <= 1.3 - Arbitrary File Upload to RCE	5 May 202118:39	–	cvelist
EUVD	EUVD-2021-11166	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24252	6 May 202113:15	–	nvd
Patchstack	WordPress Event Banner plugin <= 1.3 - Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)	10 Apr 202100:00	–	patchstack
Prion	Cross site request forgery (csrf)	6 May 202113:15	–	prion
Positive Technologies	PT-2021-3636 · WordPress · Event Banner Wordpress Plugin	5 May 202100:00	–	ptsecurity
RedhatCVE	CVE-2021-24252	22 May 202521:03	–	redhatcve
wpexploit	Event Banner <= 1.3 - Arbitrary File Upload to RCE	10 Apr 202100:00	–	wpexploit
WPVulnDB	Event Banner <= 1.3 - Arbitrary File Upload to RCE	10 Apr 202100:00	–	wpvulndb

NVD

Vulners

Node

wp-eventmanager event_bannerRange≤1.3wordpress

[
  {
    "product": "Event Banner",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.3",
        "status": "affected",
        "version": "1.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/jinhuang1102/CVE-ID-Reports/blob/master/Event%20Banner.md
wpscan	www.wpscan.com/vulnerability/91e81c6d-f24d-4f87-bc13-746715af8f7c

Parameter	Position	Path	Description	CWE
image	request body	wp-admin/admin.php?page=free_event_banner	Upload accepts arbitrary files (e.g., .php) due to lack of verification, enabling RCE	CWE-434

21 Nov 2024 05:52Current

7High risk

Vulners AI Score7

CVSS 26.5

CVSS 3.17.2

EPSS0.00991

CWE-434