CVE-2021-24311

EUVD-2021-11225
The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
Affected Products (NVD)
VendorProductVersion
external_media_projectexternal_media
𝑥
< 1.0.34
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://wpscan.com/vulnerability/4fb90999-6f91-4200-a0cc-bfe9b34a5de9
https://www.wordfence.com/blog/2021/05/critical-vulnerability-patched-in-external-media-plugin/
https://wpscan.com/vulnerability/4fb90999-6f91-4200-a0cc-bfe9b34a5de9
https://www.wordfence.com/blog/2021/05/critical-vulnerability-patched-in-external-media-plugin/