plugin

Classyfrieds Vulnerabilities

1 known security issue reported for the Classyfrieds WordPress plugin. Most recent disclosed Apr 10, 2021.

1 high

Running Classyfrieds on your site? Check whether your installed version is affected.

classyfrieds <= 3.8 - Arbitrary File Upload

high

The classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.

CVSS:: 8.8
Affected:: up to 3.8
Fix:: No patched version reported
Disclosed:: Apr 10, 2021

CVE-2021-24253 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database