CVE-2021-24253

8.8 highEPSS 1.9%

High (8.8) in classyfrieds project classyfrieds. EPSS 1.9% chance of exploitation in the next 30 days.

The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.9% chance of exploitation in the next 30 days; higher than 79% of CVEs (scores of 2026-10-31)
CWE: CWE-434
Published: 2021-05-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

classyfrieds_project:classyfrieds

References

https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/classyfrieds.md
https://wpscan.com/vulnerability/ee42c233-0ff6-4b27-a5ec-ad3246bef079
https://github.com/jinhuang1102/CVE-ID-Reports/blob/master/classyfrieds.md
https://wpscan.com/vulnerability/ee42c233-0ff6-4b27-a5ec-ad3246bef079

Check your stack JSON