blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24490

MEDIUM 6.8 CVSS 3.1
Published
September 13, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-352, CWE-434
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Description

The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS

Affected products and versions

  • Unknown Email Artillery (MASS EMAIL) — From 4.1 (including) to 4.1 (including)
  • email_artillery_project email_artillery — Up to and including 4.1

References

  • wpscan.com https://wpscan.com/vulnerability/4ea0127e-afef-41bf-a005-c57432f9f58c Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record