CVE-2021-42362

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
WordPress Popular Posts	WordPress Popular Posts	>= 0.0, <= 5.3.2

References

http://packetstormsecurity.com/files/165376/WordPress-Popular-Posts-5.3.2-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/Exploit, Third Party Advisory
https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb446e4103cb18f69897ec6fe601
https://plugins.trac.wordpress.org/changeset/2542638/wordpress-popular-posts/trunk/src/Image.phpPatch, Third Party Advisory
https://wpscan.com/vulnerability/bd4f157c-a3d7-4535-a587-0102ba4e3009Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42362Third Party Advisory
http://packetstormsecurity.com/files/165376/WordPress-Popular-Posts-5.3.2-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/Exploit, Third Party Advisory
https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb446e4103cb18f69897ec6fe601
https://plugins.trac.wordpress.org/changeset/2542638/wordpress-popular-posts/trunk/src/Image.phpPatch, Third Party Advisory
https://wpscan.com/vulnerability/bd4f157c-a3d7-4535-a587-0102ba4e3009Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-42362Third Party Advisory

Timeline

Published: Nov 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-423636.1The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in CVE-2021-423648.8The Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in CVE-2021-423654.8The Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found i CVE-2021-423675.4The Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/i CVE-2021-423698.8Imagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement thro CVE-2021-423707.5A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML passwo CVE-2021-423719.8lpar2rrd is a hardcoded system account in XoruX LPAR2RRD and STOR2RRD before 7.30.CVE-2021-423728.8A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers t CVE-2021-423735.5A NULL pointer dereference in Busybox's man applet leads to denial of service when a section name is supplied but no page argument is given CVE-2021-423745.3An out-of-bounds heap read in Busybox's unlzma applet leads to information leak and denial of service when crafted LZMA-compressed input is CVE-2021-423755.5An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due t CVE-2021-423765.5A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing valid