WordPress code issue vulnerability (CNVD-2021-44308)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code issue vulnerability exists in Business Hours Pro WordPress plugin version 5.5.0 and prior...

CVE-2021-24240

The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability...

CVE-2021-24240

CVE-2021-24240 affects the WordPress plugin Business Hours Pro (versions ≤ 5.5.0). The issue arises from the plugin’s manual update function, allowing an unauthenticated attacker to upload arbitrary files, which can lead to unauthenticated remote code execution (RCE). The exploitation path and im...

WordPress 代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A code issue vulnerability exists in Business Hours Pro WordPress plugin version 5.5.0 and prior...

WordPress Business Hours Pro plugin <= 5.5.0 - Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution (RCE)

Unauthenticated Arbitrary File Upload vulnerability leading to Remote Code Execution RCE discovered by Harald Eilertsen in WordPress Business Hours Pro plugin versions = 5.5.0. Solution No patched version is available. Deactivate and delete...

Business Hours Pro <= 5.5.0 - Unauthenticated Arbitrary File Upload to RCE

The plugin allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability. Note WPScanTeam: - The issue has been escalated to Envato on March 30th, 2021 and the plugin has been removed from the...

VulnCheck KEV: CVE-2021-24240

The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability...