CVE-2021-24638

The CVE-2021-24638 entry concerns the OMGF WordPress plugin prior to 4.5.4, where the REST API handle parameter is not escaped or validated. This allows unauthenticated users to perform path traversal and overwrite arbitrary CSS files with Google Fonts CSS, or download fonts uploaded on the Googl...

CVE-2021-24639

CVE-2021-24639 affects the OMGF WordPress plugin (versions before 4.5.4). The vulnerability is in the omgf_ajax_empty_dir AJAX action, which does not enforce path validation, authorization, or CSRF checks, allowing any authenticated user to delete arbitrary files or folders on the server. Remedia...