CVE-2021-24375
CVSS v3
9.8
CRITICAL
EPSS Score
3.0 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.
Technical details
- Published
- 2021-07-06
Frequently asked questions
What is CVE-2021-24375?
Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.
Is CVE-2021-24375 actively exploited?
Active exploitation of CVE-2021-24375 has not been confirmed. The EPSS score is 3.0%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2021-24375?
CVE-2021-24375 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2021-24375 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2021 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).