blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24620

HIGH 8.8 CVSS 3.1
Published
September 13, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-434, CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE

Affected WordPress components

  • simple-e-commerce-shopping-cart Plugin · simple-e-commerce-shopping-cart
    Confirmed match Homeless
    Up to and including 2.2.5
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal — From 2.2.5 (including) to 2.2.5 (including)
  • simple-e-commerce-shopping-cart_project simple-e-commerce-shopping-cart — Up to and including 2.2.5

References

  • wpscan.com https://wpscan.com/vulnerability/1f2b3c4a-f7e9-4d22-b71e-f6b051fd8349 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record