Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning
CVE-2021-24453

8.8HIGH

Key Information:

Vendor

Wordpress
Status
Include Me
Vendor
CVE Published:
19 July 2021

What is CVE-2021-24453?

The Include Me WordPress plugin through 1.2.1 is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution (RCE) of the system due to log poisoning and therefore potentially a full compromise of the underlying structure

Affected Version(s)

Include Me 1.2.1

References

https://wpscan.com/vulnerability/78575072-4e04-4a8a-baec-...
x_refsource_CONFIRM

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mesut Cetin
JSON
.