CVE-2021-24453

🗓️ 19 Jul 2021 10:53:18Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 79 Views🌐 WEB

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, leading to Remote Code Execution (RCE) of the system

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2021-24453	19 Jul 202114:32	–	circl
CNNVD	WordPress 路径遍历漏洞	19 Jul 202100:00	–	cnnvd
Cvelist	CVE-2021-24453 Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning	19 Jul 202110:53	–	cvelist
EUVD	EUVD-2021-11365	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24453	19 Jul 202111:15	–	nvd
OSV	CVE-2021-24453	19 Jul 202111:15	–	osv
Patchstack	WordPress Include Me plugin <= 1.2.1 - Path traversal and Local File Inclusion (LFI) vulnerability leading to Remote Code Execution (RCE)	21 Jun 202100:00	–	patchstack
Prion	Path traversal	19 Jul 202111:15	–	prion
RedhatCVE	CVE-2021-24453	22 May 202521:05	–	redhatcve
wpexploit	Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning	21 Jun 202100:00	–	wpexploit

NVD

Vulners

Node

include_me_project include_meRange≤1.2.1wordpress

[
  {
    "product": "Include Me",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.2.1",
        "status": "affected",
        "version": "1.2.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/78575072-4e04-4a8a-baec-f313cfffe829

Parameter	Position	Path	Description	CWE
content	request body	wordpress/wp-json/wp/v2/posts/116	Local File Inclusion via includeme shortcode in post content (LFI leading to potential RCE).	CWE-22
cmd	query param	wordpress/2021/06/20/myblogpost/	RCE via LFI with log poisoning using cmd parameter on published post URL.	CWE-22

21 Nov 2024 05:53Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

CVSS 29

EPSS0.07222

CWE-22