PT-2025-17369 · WordPress · Smart Product Review

Keyvan Hardani · Publicado 2025-04-19 · Atualizado 2025-04-19 · CVE-2021-4455

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Smart Product Review plugin for WordPress versions up to, and including, 1.0.4

Description The Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Recommendations For versions up to, and including, 1.0.4, update to a version that includes file type validation to prevent arbitrary file uploads. As a temporary workaround, consider restricting access to the plugin's upload functionality until a patch is available.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2021-4455

Produtos afetados

Smart Product Review

Referências · 9

• https://twitter.com/vulns_space/status/1913507292252643796 · Publicação no Twitter
• https://t.me/cvetracker/21986 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2021-4455 · Nota de Segurança
• https://twitter.com/CVEnew/status/1913675343506165844 · Publicação no Twitter
• https://t.me/cvedetector/23376 · Publicação no Telegram
• https://t.me/cvenotify/119027 · Publicação no Telegram
• https://twitter.com/cybercronai/status/1913691701769625893 · Publicação no Twitter
• https://exploit-db.com/exploits/50533 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/1de9183c-95b9-4500-85e2-08dcee956360?source=cve · Nota