CVE-2021-24222 WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE

The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the formCadastro is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction,...

CVE-2021-24222

The CVE-2021-24222 entry concerns the WP-Curriculo Vitae Free WordPress plugin (up to v6.3). The vulnerability is an unauthenticated arbitrary file upload via the page containing the [formCadastro] form, where users can submit files for profile pictures and resumes without file extension restrict...