CVE-2021-24447: WP Image Zoom < 1.47 - Local File Inclusion

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-07-19 · updated 2026-06-17
Weakness: CWE-22

Description

The WP Image Zoom WordPress plugin before 1.47 did not validate its tab parameter before using it in the include_once() function, leading to a local file inclusion issue in the admin dashboard

Affected products

WP Image Zoom: before 1.47 — fixed in 1.47

How to fix

Upgrade to a fixed version: WP Image Zoom 1.47. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/fb9dbcdf-4ffd-484d-9b67-283683d050fd
https://wpscan.com/vulnerability/fb9dbcdf-4ffd-484d-9b67-283683d050fd

Get alerted when CVE-2021-24447 or the next vulnerability affects your stack