WP Image Zoom Plugin up to 1.46 on WordPress Dashboard include_once tab file inclusion

Summaryinfo

A vulnerability was found in WP Image Zoom Plugin up to 1.46 on WordPress. It has been rated as critical. This affects the function include_once of the component Dashboard. Performing a manipulation of the argument tab results in file inclusion. This vulnerability is reported as CVE-2021-24447. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical has been found in WP Image Zoom Plugin up to 1.46 on WordPress (WordPress Plugin). This affects the function include_once of the component Dashboard. The manipulation of the argument tab with an unknown input leads to a file inclusion vulnerability. CWE is classifying the issue as CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was disclosed 07/19/2021. The advisory is shared at wpscan.com. This vulnerability is uniquely identified as CVE-2021-24447. Technical details are known, but no exploit is available.

Upgrading to version 1.47 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• WP Image Zoom Plugin

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion