Lucene search
WPScanCVELIST:CVE-2021-24639HistorySep 20, 2021 - 10:06 a.m.
CVE-2021-24639 OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
2021-09-2010:06:45
CWE-862
CWE-22
CWE-352
WPScan
www.cve.org
3
cve-2021-24639
omgf wordpress
path validation
authorisation
csrf checks
ajax action
authenticated users
server
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.
CNA Affected
[
{
"product": "OMGF | Host Google Fonts Locally",
"vendor": "Unknown",
"versions": [
{
"lessThan": "4.5.4",
"status": "affected",
"version": "4.5.4",
"versionType": "custom"
}
]
}
]Related
wpvulndb
wpvulndb
OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
2021-08-23 00:00:00
nvd
nvd
CVE-2021-24639
2021-09-20 10:15:09
cve
cve
CVE-2021-24639
2021-09-20 10:15:09
prion
prion
Cross site request forgery (csrf)
2021-09-20 10:15:00
wpexploit
wpexploit
OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
2021-08-23 00:00:00