CVE-2021-24212

CRITICAL 9.8CVE-2021-24212 · Published 05/04/2021 · updated 17/06/2026

In short

CVE-2021-24212 is a CRITICAL (CVSS 9.8) vulnerability affecting help scout (woocommerce).
Chance of exploitation in the next 30 days (EPSS): 7.9%, higher than 94.7% of all vulnerabilities.
Fix: update to 2.9.1 or later.

Package	Affected versions	Patched versions
help scout woocommerce	`< 2.9.1`	`2.9.1`

Description

The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp.

References

dzv365zjfbd8v.cloudfront.net/changelogs/woocommerce-help-scout/changelog.txt · Release Notes
wpscan.com/vulnerability/cf9305e8-f5bc-45c3-82db-0ef00fd46129 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free