CVE-2021-24453

🗓️ 19 Jul 2021 10:53:18Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 94 Views🌐 WEB

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, leading to Remote Code Execution (RCE) of the system

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2021-24453	19 Jul 202111:15	–	attackerkb
Circl	CVE-2021-24453	19 Jul 202114:32	–	circl
CNNVD	WordPress 路径遍历漏洞	19 Jul 202100:00	–	cnnvd
Cvelist	CVE-2021-24453 Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning	19 Jul 202110:53	–	cvelist
EUVD	EUVD-2021-11365	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24453	19 Jul 202111:15	–	nvd
OSV	CVE-2021-24453	19 Jul 202111:15	–	osv
Patchstack	WordPress Include Me plugin <= 1.2.1 - Path traversal and Local File Inclusion (LFI) vulnerability leading to Remote Code Execution (RCE)	21 Jun 202100:00	–	patchstack
Prion	Path traversal	19 Jul 202111:15	–	prion
RedhatCVE	CVE-2021-24453	22 May 202521:05	–	redhatcve

NVD

Vulners

Node

include_me_project include_meRange≤1.2.1wordpress

[
  {
    "product": "Include Me",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.2.1",
        "status": "affected",
        "version": "1.2.1",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/78575072-4e04-4a8a-baec-f313cfffe829

Parameter	Position	Path	Description	CWE
content	request body	wordpress/wp-json/wp/v2/posts/116	Path traversal/LFI via includeme shortcode leading to potential RCE	CWE-22
cmd	query param	wordpress/2021/06/20/myblogpost/	RCE via log-poisoning/LFI when accessing the post with a crafted cmd parameter	CWE-22

17 Jun 2026 03:40Current

8.9High risk

Vulners AI Score8.9

CVSS 3.18.8

CVSS 29

EPSS0.04956

CWE-22