PT-2021-15906 · Unknown · Fancy Product Designer

Charles Sweethill + 1 · Published 2021-06-21 · Updated 2023-11-02 · CVE-2021-24370

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fancy Product Designer versions prior to 4.6.9

Description The issue allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.

Recommendations For versions prior to 4.6.9, update to version 4.6.9 or later to resolve the issue.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-24370

Affected Products

Fancy Product Designer

References · 7

• 🔥 https://secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin · Exploit
• 🔥 https://lists.openwall.net/full-disclosure/2020/11/17/2 · Exploit
• 🔥 https://seclists.org/fulldisclosure/2020/Nov/30 · Exploit
• 🔥 https://wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack · Exploit
• 🔥 https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24370 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24370 · Vendor Advisory