CVE-2021-24639

HIGH 8.1CVE-2021-24639 · Published 20/09/2021 · updated 17/06/2026

In short

CVE-2021-24639 is a HIGH (CVSS 8.1) vulnerability affecting omgf (ffw).
Chance of exploitation in the next 30 days (EPSS): 0.91%, higher than 60.2% of all vulnerabilities.
Fix: update to 4.5.4 or later.

Package	Affected versions	Patched versions
omgf ffw	`< 4.5.4`	`4.5.4`

Description

The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server.

References

wpscan.com/vulnerability/1ada2a96-32aa-4e37-809c-705db6026e0b · Exploit

More vulnerabilities in omgf

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free