CVE-2021-24240 Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE

2021-04-2221:00:51

CWE-434

WPScan

www.cve.org

wordpress plugin

remote code execution

unauthenticated

arbitrary file upload

AI Score

Confidence

High

EPSS

0.007

Percentile

81.0%

JSON

The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.

CNA Affected

[
  {
    "product": "Business Hours Pro",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "5.5.0",
        "status": "affected",
        "version": "5.5.0",
        "versionType": "custom"
      }
    ]
  }
]