Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-24222

WP-Curricul Vitea Free <= 6.3 - Unauthenticated Arbitrary File Upload to RCE

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown WP-Curriculo Vitae Free

  • 6.3 to ≤ 6.3affected

References