CVE-2021-4382

ALTO 8.8CVE-2021-4382 · Published 07/06/2023 · updated 17/06/2026

In breve

CVE-2021-4382 è una vulnerabilità ALTO (CVSS 8.8) che riguarda recently (recently project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.6%, superiore al 76.2% delle vulnerabilità.
Correzione: aggiornare a 3.0.5 o successiva.

Package	Affected versions	Patched versions
recently recently_project	`< 3.0.5`	`3.0.5`

Description

The Recently plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the fetch_external_image() function in versions up to, and including, 3.0.4. This makes it possible for authenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

References

plugins.trac.wordpress.org/changeset/2542693 · Release Notes
wpscan.com/vulnerability/92c3f26a-1a84-459a-874b-07dc83c9f42a · Third Party Advisory
acunetix.com/vulnerabilities/web/wordpress-plugin-recently-multiple-vulnerabilities-3-0-4 · Third Party Advisory
wordfence.com/threat-intel/vulnerabilities/id/f8297149-2de3-4e49-80f9-6ea59dea6bce · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free