CVE-2021-4096

Summary

The Fancy Product Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery via the FPD_Admin_Import class that makes it possible for attackers to upload malicious files that could be used to gain webshell access to a server in versions up to, and including, 4.7.5.

Affected Software

Weaknesses

• CWE-352: CWE-352 Cross-Site Request Forgery (CSRF)
• CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type

ADP Enrichment

CVE Program Container

Additional References

• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096
• https://support.fancyproductdesigner.com/support/discussions/topics/13000031615

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

References

• https://www.wordfence.com/vulnerability-advisories/#CVE-2021-4096
• https://support.fancyproductdesigner.com/support/discussions/topics/13000031615

• ←Previous
• Next→