{"vulnerability": "CVE-2021-4236", "sightings": [{"uuid": "66e5691d-8a11-4600-bfef-6175ab9da679", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "c2424c9f-bb2b-4d0a-bc05-d232c1f33d99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:40.000000Z"}, {"uuid": "afae9d25-cc72-4b8e-bd01-4b42b76481c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_popular_posts_rce.rb", "content": "", "creation_timestamp": "2021-12-20T15:49:01.000000Z"}, {"uuid": "94845aad-277a-463d-a76e-13e2009b4fe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "published-proof-of-concept", "source": "Telegram/ZJp_VCEhaga9OM9NBvz45K3ssC6nL69JeV_dGqoHwNSpsGU", "content": "", "creation_timestamp": "2025-04-15T05:00:08.000000Z"}, {"uuid": "efafca6b-df0f-4942-9ebe-8601cbe1546f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-4236", "type": "seen", "source": "https://t.me/cibsecurity/55460", "content": "\u203c CVE-2021-4236 \u203c\n\nWeb Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not explicitly use WebSockets are not vulnerable.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-12-28T00:12:15.000000Z"}, {"uuid": "aa036871-e044-4fd7-ae72-abdf678d991b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42367", "type": "seen", "source": "https://t.me/cibsecurity/33941", "content": "\u203c CVE-2021-42367 \u203c\n\nThe Variation Swatches for WooCommerce WordPress plugin is vulnerable to Stored Cross-Site Scripting via several parameters found in the ~/includes/class-menu-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.1.1. Due to missing authorization checks on the tawcvs_save_settings function, low-level authenticated users such as subscribers can exploit this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-12-14T18:15:31.000000Z"}, {"uuid": "c6c99b28-5d3b-4060-8d53-0ff9d3d89840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42364", "type": "seen", "source": "https://t.me/cibsecurity/33065", "content": "\u203c CVE-2021-42364 \u203c\n\nThe Stetic WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the stats_page function found in the ~/stetic.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.0.6.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-29T22:33:44.000000Z"}, {"uuid": "b4ed6276-5417-4e17-a17e-056133b57ab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42365", "type": "seen", "source": "https://t.me/cibsecurity/33061", "content": "\u203c CVE-2021-42365 \u203c\n\nThe Asgaros Forums WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the name parameter found in the ~/admin/tables/admin-structure-table.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.13. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-29T22:33:39.000000Z"}, {"uuid": "98db6a7b-bd7e-4fe5-aad1-92a1fe841272", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42363", "type": "seen", "source": "https://t.me/cibsecurity/32699", "content": "\u203c CVE-2021-42363 \u203c\n\nThe Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the search_order parameter found in the ~/views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-19T18:23:20.000000Z"}, {"uuid": "e3d01a0a-8cde-4459-a2d1-c704c0b6d379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42360", "type": "seen", "source": "https://t.me/cibsecurity/32532", "content": "\u203c CVE-2021-42360 \u203c\n\nOn sites that also had the Elementor plugin for WordPress installed, it was possible for users with the edit_posts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An attacker could craft and host a block containing malicious JavaScript on a server they controlled, and then use it to overwrite any post or page by sending an AJAX request with the action set to astra-page-elementor-batch-process and the url parameter pointed to their remotely-hosted malicious block, as well as an id parameter containing the post or page to overwrite. Any post or page that had been built with Elementor, including published pages, could be overwritten by the imported block, and the malicious JavaScript in the imported block would then be executed in the browser of any visitors to that page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-17T20:14:40.000000Z"}, {"uuid": "b1cf3db8-b015-4d55-881e-2b8aeb1afd27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "https://t.me/cibsecurity/32531", "content": "\u203c CVE-2021-42362 \u203c\n\nThe WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-17T20:14:39.000000Z"}, {"uuid": "6c3de8d3-fbb3-4584-a782-7da56108926a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42369", "type": "seen", "source": "https://t.me/cibsecurity/30593", "content": "\u203c CVE-2021-42369 \u203c\n\nImagicle Application Suite (for Cisco UC) before 2021.Summer.2 allows SQL injection. A low-privileged user could inject a SQL statement through the \"Export to CSV\" feature of the Contact Manager web GUI.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-14T22:27:47.000000Z"}, {"uuid": "4ac03336-abe7-4349-b163-171cba8d4c94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42363", "type": "seen", "source": "https://t.me/hacking_Attack/31891", "content": "Exploit Collector\nWordPress Preview E-mails For WooCommerce 1.6.8 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nWordPress Preview E-mails for WooCommerce plugin versions 1.6.8 and below suffer from a cross site scripting vulnerability.\n\nMD5 | c46da50d03a7e43bbff2b3dc283f9317\n\nDownload\nDescription: Reflected Cross-Site Scripting\n\nAffected Plugin: Preview E-mails for WooCommerce\n\nPlugin Slug: woo-preview-emails\n\nAffected Versions: <=\n\nCVE ID: CVE-2021-42363\n\nCVSS Score: 6.1 (Medium)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nResearcher/s: Chloe Chamberland\n\nFully Patched Version: 2.0.0\n\nPreview E-mails for WooCommerce is a simple plugin designed to give site owners the ability to preview the emails that are sent to customers via WooCommerce. Unfortunately, the plugin had a flaw that made it possible for attackers to inject malicious web scripts into the `digthis-woocommerce-preview-emails` page.\n\nAs part of the plugin\u2019s functionality, there is a feature to search orders and to generate an email preview based upon a specific order, so that an administrator or shop manager can see exactly what a specific user sees for the emails that get sent out. Unfortunately, the search_orders parameter, used to conduct the search, was reflected to the page and had no input sanitization or escaping upon output which made it possible for users to supply arbitrary scripts that would execute in the browser when the page was accessed with the payload set in the search_orders parameter.\n\nThis meant that if an attacker could successfully convince a site administrator to click on a link, they could get malicious JavaScript to execute in that administrator\u2019s browser. This script could be crafted to inject a new administrative user or even modify a plugin or theme file to include a backdoor which in turn would grant the attacker the ability to completely take over the site.\n\nTimeline\n\nNovember 1, 2021 \u2013 Conclusion of the plugin analysis that led to the discovery of a Reflected Cross-Site Scripting Vulnerability in the Preview E-mails for WooCommerce plugin. We validate that the Wordfence Firewall provides complete protection. We initiate contact with the developer.\n\nNovember 3, 2021 \u2013 The developer confirms the inbox for handling the discussion.\n\nNovember 4, 2021 \u2013 We send over the full disclosure details.\n\nOctober 8, 2021 \u2013 A fully patched version of the plugin is released as version 2.0.0.\n\nConclusion\n\nIn today\u2019s post, we detailed a flaw in the Preview E-mails for WooCommerce plugin that made it possible for attackers to inject malicious web scripts into a page that would execute if an attacker successfully tricked a site administrator into performing an action. This flaw has been fully patched in version 2.0.0.\n\nWe recommend that WordPress users immediately verify that their site has been updated to the latest patched version available, which is version 2.0.1 at the time of this publication.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:08.910658Z"}, {"uuid": "2fa756b6-30b7-4e53-b7d0-5b69cfff38ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42363", "type": "seen", "source": "https://t.me/hacking_Attack/31891", "content": "Exploit Collector\nWordPress Preview E-mails For WooCommerce 1.6.8 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nWordPress Preview E-mails for WooCommerce plugin versions 1.6.8 and below suffer from a cross site scripting vulnerability.\n\nMD5 | c46da50d03a7e43bbff2b3dc283f9317\n\nDownload\nDescription: Reflected Cross-Site Scripting\n\nAffected Plugin: Preview E-mails for WooCommerce\n\nPlugin Slug: woo-preview-emails\n\nAffected Versions: <=\n\nCVE ID: CVE-2021-42363\n\nCVSS Score: 6.1 (Medium)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nResearcher/s: Chloe Chamberland\n\nFully Patched Version: 2.0.0\n\nPreview E-mails for WooCommerce is a simple plugin designed to give site owners the ability to preview the emails that are sent to customers via WooCommerce. Unfortunately, the plugin had a flaw that made it possible for attackers to inject malicious web scripts into the `digthis-woocommerce-preview-emails` page.\n\nAs part of the plugin\u2019s functionality, there is a feature to search orders and to generate an email preview based upon a specific order, so that an administrator or shop manager can see exactly what a specific user sees for the emails that get sent out. Unfortunately, the search_orders parameter, used to conduct the search, was reflected to the page and had no input sanitization or escaping upon output which made it possible for users to supply arbitrary scripts that would execute in the browser when the page was accessed with the payload set in the search_orders parameter.\n\nThis meant that if an attacker could successfully convince a site administrator to click on a link, they could get malicious JavaScript to execute in that administrator\u2019s browser. This script could be crafted to inject a new administrative user or even modify a plugin or theme file to include a backdoor which in turn would grant the attacker the ability to completely take over the site.\n\nTimeline\n\nNovember 1, 2021 \u2013 Conclusion of the plugin analysis that led to the discovery of a Reflected Cross-Site Scripting Vulnerability in the Preview E-mails for WooCommerce plugin. We validate that the Wordfence Firewall provides complete protection. We initiate contact with the developer.\n\nNovember 3, 2021 \u2013 The developer confirms the inbox for handling the discussion.\n\nNovember 4, 2021 \u2013 We send over the full disclosure details.\n\nOctober 8, 2021 \u2013 A fully patched version of the plugin is released as version 2.0.0.\n\nConclusion\n\nIn today\u2019s post, we detailed a flaw in the Preview E-mails for WooCommerce plugin that made it possible for attackers to inject malicious web scripts into a page that would execute if an attacker successfully tricked a site administrator into performing an action. This flaw has been fully patched in version 2.0.0.\n\nWe recommend that WordPress users immediately verify that their site has been updated to the latest patched version available, which is version 2.0.1 at the time of this publication.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:35.059037Z"}, {"uuid": "c3df72dd-f8bf-41dd-9968-51c1f09de551", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42363", "type": "seen", "source": "https://t.me/hacking_Attack/31891", "content": "Exploit Collector\nWordPress Preview E-mails For WooCommerce 1.6.8 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nWordPress Preview E-mails for WooCommerce plugin versions 1.6.8 and below suffer from a cross site scripting vulnerability.\n\nMD5 | c46da50d03a7e43bbff2b3dc283f9317\n\nDownload\nDescription: Reflected Cross-Site Scripting\n\nAffected Plugin: Preview E-mails for WooCommerce\n\nPlugin Slug: woo-preview-emails\n\nAffected Versions: <=\n\nCVE ID: CVE-2021-42363\n\nCVSS Score: 6.1 (Medium)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nResearcher/s: Chloe Chamberland\n\nFully Patched Version: 2.0.0\n\nPreview E-mails for WooCommerce is a simple plugin designed to give site owners the ability to preview the emails that are sent to customers via WooCommerce. Unfortunately, the plugin had a flaw that made it possible for attackers to inject malicious web scripts into the `digthis-woocommerce-preview-emails` page.\n\nAs part of the plugin\u2019s functionality, there is a feature to search orders and to generate an email preview based upon a specific order, so that an administrator or shop manager can see exactly what a specific user sees for the emails that get sent out. Unfortunately, the search_orders parameter, used to conduct the search, was reflected to the page and had no input sanitization or escaping upon output which made it possible for users to supply arbitrary scripts that would execute in the browser when the page was accessed with the payload set in the search_orders parameter.\n\nThis meant that if an attacker could successfully convince a site administrator to click on a link, they could get malicious JavaScript to execute in that administrator\u2019s browser. This script could be crafted to inject a new administrative user or even modify a plugin or theme file to include a backdoor which in turn would grant the attacker the ability to completely take over the site.\n\nTimeline\n\nNovember 1, 2021 \u2013 Conclusion of the plugin analysis that led to the discovery of a Reflected Cross-Site Scripting Vulnerability in the Preview E-mails for WooCommerce plugin. We validate that the Wordfence Firewall provides complete protection. We initiate contact with the developer.\n\nNovember 3, 2021 \u2013 The developer confirms the inbox for handling the discussion.\n\nNovember 4, 2021 \u2013 We send over the full disclosure details.\n\nOctober 8, 2021 \u2013 A fully patched version of the plugin is released as version 2.0.0.\n\nConclusion\n\nIn today\u2019s post, we detailed a flaw in the Preview E-mails for WooCommerce plugin that made it possible for attackers to inject malicious web scripts into a page that would execute if an attacker successfully tricked a site administrator into performing an action. This flaw has been fully patched in version 2.0.0.\n\nWe recommend that WordPress users immediately verify that their site has been updated to the latest patched version available, which is version 2.0.1 at the time of this publication.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T04:00:03.880819Z"}, {"uuid": "91cf1b41-f187-4ba8-814f-81e1c1d1a19f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42363", "type": "seen", "source": "https://t.me/hacking_Attack/31891", "content": "Exploit Collector\nWordPress Preview E-mails For WooCommerce 1.6.8 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png \nWordPress Preview E-mails for WooCommerce plugin versions 1.6.8 and below suffer from a cross site scripting vulnerability.\n\nMD5 | c46da50d03a7e43bbff2b3dc283f9317\n\nDownload\nDescription: Reflected Cross-Site Scripting\n\nAffected Plugin: Preview E-mails for WooCommerce\n\nPlugin Slug: woo-preview-emails\n\nAffected Versions: <=\n\nCVE ID: CVE-2021-42363\n\nCVSS Score: 6.1 (Medium)\n\nCVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nResearcher/s: Chloe Chamberland\n\nFully Patched Version: 2.0.0\n\nPreview E-mails for WooCommerce is a simple plugin designed to give site owners the ability to preview the emails that are sent to customers via WooCommerce. Unfortunately, the plugin had a flaw that made it possible for attackers to inject malicious web scripts into the `digthis-woocommerce-preview-emails` page.\n\nAs part of the plugin\u2019s functionality, there is a feature to search orders and to generate an email preview based upon a specific order, so that an administrator or shop manager can see exactly what a specific user sees for the emails that get sent out. Unfortunately, the search_orders parameter, used to conduct the search, was reflected to the page and had no input sanitization or escaping upon output which made it possible for users to supply arbitrary scripts that would execute in the browser when the page was accessed with the payload set in the search_orders parameter.\n\nThis meant that if an attacker could successfully convince a site administrator to click on a link, they could get malicious JavaScript to execute in that administrator\u2019s browser. This script could be crafted to inject a new administrative user or even modify a plugin or theme file to include a backdoor which in turn would grant the attacker the ability to completely take over the site.\n\nTimeline\n\nNovember 1, 2021 \u2013 Conclusion of the plugin analysis that led to the discovery of a Reflected Cross-Site Scripting Vulnerability in the Preview E-mails for WooCommerce plugin. We validate that the Wordfence Firewall provides complete protection. We initiate contact with the developer.\n\nNovember 3, 2021 \u2013 The developer confirms the inbox for handling the discussion.\n\nNovember 4, 2021 \u2013 We send over the full disclosure details.\n\nOctober 8, 2021 \u2013 A fully patched version of the plugin is released as version 2.0.0.\n\nConclusion\n\nIn today\u2019s post, we detailed a flaw in the Preview E-mails for WooCommerce plugin that made it possible for attackers to inject malicious web scripts into a page that would execute if an attacker successfully tricked a site administrator into performing an action. This flaw has been fully patched in version 2.0.0.\n\nWe recommend that WordPress users immediately verify that their site has been updated to the latest patched version available, which is version 2.0.1 at the time of this publication.\n\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:01:00.216362Z"}, {"uuid": "04891e46-5832-4c17-bfde-719879509ef7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42362", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_popular_posts_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"h00die\", \"Simone Cristofaro\", \"Jerome Bruandet\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit requires Metasploit to have a FQDN and the ability to run a payload web server on port 80, 443, or 8080.\\n          The FQDN must also not resolve to a reserved address (192/172/127/10).  The server must also respond to a HEAD request\\n          for the payload, prior to getting a GET request.\\n          This exploit leverages an authenticated improper input validation in Wordpress plugin Popular Posts <= 5.3.2.\\n          The exploit chain is rather complicated.  Authentication is required and 'gd' for PHP is required on the server.\\n          Then the Popular Post plugin is reconfigured to allow for an arbitrary URL for the post image in the widget.\\n          A post is made, then requests are sent to the post to make it more popular than the previous #1 by 5. Once\\n          the post hits the top 5, and after a 60sec (we wait 90) server cache refresh, the homepage widget is loaded\\n          which triggers the plugin to download the payload from our server. Our payload has a 'GIF' header, and a\\n          double extension ('.gif.php') allowing for arbitrary PHP code to be executed.\", \"disclosure_date\": \"2021-06-11\", \"fullname\": \"exploit/multi/http/wp_popular_posts_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-11 21:31:08 +0000\", \"name\": \"Wordpress Popular Posts Authenticated RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/wp_popular_posts_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"multi/http/wp_popular_posts_rce\", \"references\": [\"EDB-50129\", \"URL-https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/\", \"WPVDB-bd4f157c-a3d7-4535-a587-0102ba4e3009\", \"URL-https://plugins.trac.wordpress.org/changeset/2542638\", \"URL-https://github.com/cabrerahector/wordpress-popular-posts/commit/d9b274cf6812eb446e4103cb18f69897ec6fe601\", \"CVE-2021-42362\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Automatic Target\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:22.696227Z"}]}