CVE-2021-24212: WooCommerce Help Scout < 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-04-05 · updated 2026-06-17
Weakness: CWE-434

Description

The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allows unauthenticated users to upload any files to the site which by default will end up in wp-content/uploads/hstmp.

Affected products

WooCommerce Help Scout: before 2.9.1 — fixed in 2.9.1

How to fix

Upgrade to a fixed version: WooCommerce Help Scout 2.9.1. Check the vendor advisory for mitigations.

References

http://dzv365zjfbd8v.cloudfront.net/changelogs/woocommerce-help-scout/changelog.txt
https://wpscan.com/vulnerability/cf9305e8-f5bc-45c3-82db-0ef00fd46129
http://dzv365zjfbd8v.cloudfront.net/changelogs/woocommerce-help-scout/changelog.txt
https://wpscan.com/vulnerability/cf9305e8-f5bc-45c3-82db-0ef00fd46129

Get alerted when CVE-2021-24212 or the next vulnerability affects your stack