CVE-2021-24721
Medium
Description
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.
SeverityMedium
CVSS6.5
Exploit probability—
ProductLoco Translate
PublishedNov 8, 2021
First seenNov 8, 2021
Weakness typeCWE-94Code injection
How to fix
Update
- loco_translate_project loco_translate2.5.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| loco_translate_project loco_translate | v < 2.5.4 | 2.5.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.