What’s Vulnerable › Vulnerabilities

CVE-2021-24490: Email Artillery <= 4.1 - Arbitrary File Upload

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-13 · updated 2026-06-17
• Weakness: CWE-352

Description

The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS

Affected products

• Email Artillery (MASS EMAIL): through 4.1

References

• https://wpscan.com/vulnerability/4ea0127e-afef-41bf-a005-c57432f9f58c
• https://wpscan.com/vulnerability/4ea0127e-afef-41bf-a005-c57432f9f58c

Get alerted when CVE-2021-24490 or the next vulnerability affects your stack