CVE-2021-24981

    Dashboard / Vulnerabilities / CVE-2021-24981

    CVE-2021-24981

    Published: 21 Dec 2021Last Modified: 9 Jul 2026

    Summary:

    Details: The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.

    References: https://blog.sucuri.net/2021/11/fake-ransomware-infection-spooks-website-owners.html, https://wpscan.com/vulnerability/4c45df6d-b3f6-49e5-8b1f-edd32a12d71c

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -77faf362d57d3d21b90db4345aa5e051dc60d4e4

    Affected versions

    v7.0.6.1
    v7.0.6
    v7.0.5.6
    v7.0.5.4
    v7.0.5.3
    v7.0.5.2
    v7.0.5.1
    v7.0.5
    v7.0.4.1
    v7.0.3.3
    v7.0.3.2
    v7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-24981 | CVE-DB