CVE-2021-24223
CRITICALN5 Upload Form < 1.0 - Unauthenticated Arbitrary File Upload via Form Embed
Title source: llmDescription
The N5 Upload Form WordPress plugin through 1.0 suffers from an arbitrary file upload issue in page where a Form from the plugin is embed, as any file can be uploaded. The uploaded filename might be hard to guess as it's generated with md5(uniqid(rand())), however, in the case of misconfigured servers with Directory listing enabled, accessing it is trivial.
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://wpscan.com/vulnerability/d7a72183-0cd1-45de-b98b-2e295b27e5db
Exploit, Third Party Advisory x_refsource_misc
https://github.com/jinhuang1102/CVE-ID-Reports/blob/12863f80ced5361e2e2c3f7209566ab3730aa37b/N5_upload.md
Scores
CVSS v3
9.8
EPSS
0.0221
EPSS Percentile
80.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-434
Status
published
Products (1)
n5_upload_form_project/n5_upload_form
< 1.0
Published
Apr 12, 2021
Tracked Since
Feb 18, 2026