CVE-2021-24966 EXPLOIT
4.9
MEDIUM · CVSS 3.1 · EPSS 5.2% (pctl 92)
Patch early
A public exploit exists.
Description
The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder
Scoring
| CVSS | 4.9 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
| EPSS | 5.19% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-73 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2022-03-14 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| bestwebsoft | error log viewer |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated) | 2022-02-16 |
References
→ the Explorer · watch your stack · NVD