CVEs-PoC/2021/CVE-2021-24962.md

### [CVE-2021-24962](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24962)
![](https://img.shields.io/static/v1?label=Product&message=WordPress%20File%20Upload%20Pro&color=blue)
![](https://img.shields.io/static/v1?label=Product&message=WordPress%20File%20Upload&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=4.16.3%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brightgreen)

### Description

The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution.

### POC

#### Reference
- https://plugins.trac.wordpress.org/changeset/2677722
- https://wpscan.com/vulnerability/7a95b3f2-285e-40e3-aead-41932c207623

#### Github
- https://github.com/20142995/nuclei-templates
- https://github.com/syedayman/Network-PenTest-Project
- https://github.com/syedayman/Penetration-Test