WordPress Fancy Product Designer <4.6.9 - Arbitrary File Upload

criticalseverity

9.8CVSS score

47.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WordPress Fancy Product Designer plugin before 4.6.9 is susceptible to an arbitrary file upload. An attacker can upload malicious files and execute code on the server, modify data, and/or gain full control over a compromised system without authentication.

Impact

Attackers can upload malicious files and execute arbitrary code on the target system.

Fix

Update WordPress Fancy Product Designer plugin to version 4.6.9 or later to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php
Positive when: contains "{\"error\":\"You need to define a directory" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-24370 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-24370

info:
  name: WordPress Fancy Product Designer <4.6.9 - Arbitrary File Upload
  author: pikpikcu
  severity: critical
  description: |
    WordPress Fancy Product Designer plugin before 4.6.9 is susceptible to an arbitrary file upload. An attacker can upload malicious files and execute code on the server, modify data, and/or gain full control over a compromised system without authentication.
  impact: |
    Attackers can upload malicious files and execute arbitrary code on the target system.
  remediation: |
    Update WordPress Fancy Product Designer plugin to version 4.6.9 or later to fix the vulnerability.
  reference:
    - https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/
    - https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38
    - https://seclists.org/fulldisclosure/2020/Nov/30
    - https://nvd.nist.gov/vuln/detail/CVE-2021-24370
    - https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-24370
    cwe-id: CWE-434
    epss-score: 0.47371
    epss-percentile: 0.9885
    cpe: cpe:2.3:a:radykal:fancy_product_designer:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    vendor: radykal
    product: fancy_product_designer
    framework: wordpress
    google-query: inurl:“/wp-content/plugins/fancy-product-designer”
  tags: cve2021,cve,wordpress,wp,seclists,wpscan,rce,wp-plugin,fancyproduct,radykal,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"error":"You need to define a directory'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from