PT-2021-16021 · WordPress · Workreap

Harald Eilertsen · Published 2021-08-09 · Updated 2023-06-12 · CVE-2021-24499

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Workreap WordPress theme versions prior to 2.2.2

Description The issue allows unauthenticated visitors to upload arbitrary files, including executable code like php scripts, to the uploads/workreap-temp directory due to the lack of nonce checks and validation in the workreap award temp file uploader and workreap temp file uploader AJAX actions. The uploaded files are not sanitized or validated.

Recommendations For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue. As a temporary workaround, consider disabling the workreap award temp file uploader and workreap temp file uploader functions until a patch is available. Restrict access to the uploads/workreap-temp directory to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-24499

Affected Products

Workreap

References · 10

• 🔥 https://github.com/j4k0m/CVE-2021-24499 · Exploit
• 🔥 https://github.com/RyouYoo/CVE-2021-24499 · Exploit
• 🔥 https://exploit-db.com/exploits/51510 · Exploit
• 🔥 https://wpscan.com/vulnerability/74611d5f-afba-42ae-bc19-777cdf2808cb · Exploit
• 🔥 https://jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24499 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24499 · Vendor Advisory
• http://packetstormsecurity.com/files/172876/WordPress-Workreap-2.2.2-Shell-Upload.html · Note
• https://t.me/cybersecuritytechnologies/4293 · Telegram Post
• https://t.me/cvenotify/19862 · Telegram Post