PT-2025-17369 · WordPress · Smart Product Review

Keyvan Hardani · Published 2025-04-19 · Updated 2025-04-19 · CVE-2021-4455

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Smart Product Review plugin for WordPress versions up to, and including, 1.0.4

Description The Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server, which may make remote code execution possible.

Recommendations For versions up to, and including, 1.0.4, update to a version that includes file type validation to prevent arbitrary file uploads. As a temporary workaround, consider restricting access to the plugin's upload functionality until a patch is available.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-4455

Affected Products

Smart Product Review

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2021-4455 · Security Note
• https://twitter.com/vulns_space/status/1913507292252643796 · Twitter Post
• https://t.me/cvetracker/21986 · Telegram Post
• https://twitter.com/CVEnew/status/1913675343506165844 · Twitter Post
• https://t.me/cvedetector/23376 · Telegram Post
• https://t.me/cvenotify/119027 · Telegram Post
• https://twitter.com/cybercronai/status/1913691701769625893 · Twitter Post
• https://exploit-db.com/exploits/50533 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/1de9183c-95b9-4500-85e2-08dcee956360?source=cve · Note