Back to search
CVE-2021-24721
Published: Nov 8, 2021
Modified: Aug 3, 2024
PUBLISHED
Description
The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.
| Vendor | Product | Versions |
|---|---|---|
Unknown | Loco Translate | affected 2.5.4 - < 2.5.4 |
Weaknesses (CWE)
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now