{"cve":"CVE-2021-24375","nvd":{"published":"2021-07-06T11:15:08.713","modified":"2026-06-17T03:39:55.390","status":"Modified","description":"Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-22"],"references":["https://jetpack.com/2021/06/09/motor-wordpress-theme-vulnerabilities/","https://wpscan.com/vulnerability/d9518429-79d3-4b13-88ff-3722d05efa9f","https://jetpack.com/2021/06/09/motor-wordpress-theme-vulnerabilities/","https://wpscan.com/vulnerability/d9518429-79d3-4b13-88ff-3722d05efa9f"],"products":["stockware:motor"],"source":"nvd","synced_at":"2026-10-19T21:20:07.141963181+00:00"},"epss":{"cve":"CVE-2021-24375","score":0.02633,"percentile":0.85538,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}