CVE-2021-4455

CRITICAL

Wordpress Plugin Smart Product Review <= 1.0.4 - Unauthenticated Arbitrary File Upload

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-4455 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit.

Description

The Wordpress Plugin Smart Product Review plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 21, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Wordpress Plugin Smart Product Review

Browse Codeflist / Wordpress Plugin Smart Product Review

Default status: unaffected

CVE ListThrough 1.0.4affected

Proofs of concept

1

Catalogued exploits

ExploitDBWordpress Plugin Smart Product Review 1.0.4 - Arbitrary File UploadExploitDB exploitby Keyvan HardaniNot analyzed1 file
ExploitDB
PoC details

References

3