PT-2021-15725 · WordPress · The Business Directory Plugin

0Xb9 · Published 2021-05-05 · Updated 2021-05-13 · CVE-2021-24179

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin – Easy Listing Directories for WordPress versions prior to 5.11

Description: The issue allows an attacker to make a logged-in administrator import files due to a Cross-Site Request Forgery problem. Additionally, the plugin's failure to validate uploaded files could lead to Remote Code Execution (RCE).

Recommendations: For versions prior to 5.11, update to version 5.11 or later to resolve the issue. As a temporary workaround, consider restricting file import functionality to minimize the risk of exploitation. Avoid using the file import feature until the issue is resolved.

Exploit

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24179

Affected Products

The Business Directory Plugin

References · 3

• 🔥 https://wpscan.com/vulnerability/c0a5cdde-732a-432a-86c2-776df5d130a7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24179 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24179 · Vendor Advisory