CVE-2021-34624

ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload

criticalUnrestricted Upload of File with Dangerous Type

9.8

CVSS Score

9.8

CVSS Score

critical

Severity

3.1.4

Patched in

938d

Time to patch

Description

A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects versions 3.0.0 - 3.1.3.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

High

Confidentiality

High

Integrity

High

Availability

Technical Details

Affected versions>=3.0.0 <=3.1.3

PublishedJune 28, 2021

Last updatedJanuary 22, 2024

Affected pluginwp-user-avatar

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/68e838d4-2ff2-4925-b2ff-ba3f7b379010?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database