CVE-2021-24236
06.05.2021, 13:15
The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE.Enginsight
| Vendor | Product | Version |
|---|---|---|
| imagements_project | imagements | 𝑥 ≤ 1.2.5 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration