What’s Vulnerable › Vulnerabilities

CVE-2021-24370: Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 47.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-21 · updated 2026-06-17
• Weakness: CWE-434

Description

The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.

Affected products

• radykal Fancy Product Designer: before 4.6.9 — fixed in 4.6.9

How to fix

Upgrade to a fixed version: radykal Fancy Product Designer 4.6.9. Check the vendor advisory for mitigations.

References

• https://lists.openwall.net/full-disclosure/2020/11/17/2
• https://seclists.org/fulldisclosure/2020/Nov/30
• https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38
• https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/
• https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/
• https://lists.openwall.net/full-disclosure/2020/11/17/2
• https://seclists.org/fulldisclosure/2020/Nov/30
• https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38
• https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/
• https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/

Get alerted when CVE-2021-24370 or the next vulnerability affects your stack