What’s Vulnerable › Vulnerabilities

CVE-2021-24224: Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-12 · updated 2026-06-17
• Weakness: CWE-434

Description

The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.

Affected products

• Easy-Form-Builder-By-Bitware Project Easy-Form-Builder-By-Bitware: through 1.0

References

• https://github.com/jinhuang1102/CVE-ID-Reports/blob/e4c33529b20fa70e3a764ff9b1125839fb9900b5/Easy%20Form%20Builder.md
• https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484
• https://github.com/jinhuang1102/CVE-ID-Reports/blob/e4c33529b20fa70e3a764ff9b1125839fb9900b5/Easy%20Form%20Builder.md
• https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484

Get alerted when CVE-2021-24224 or the next vulnerability affects your stack