What’s Vulnerable › Vulnerabilities

CVE-2021-24537: Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code Execution

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-08 · updated 2026-06-17
• Weakness: CWE-94

Description

The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML set to true) via the 'widget_rrm_similar_posts_condition' widget setting of the plugin.

Affected products

• Shareaholic Similar Posts: through 3.1.5

References

• https://wpscan.com/vulnerability/0d6b46cb-5244-486f-ad70-4023907ac9eb
• https://wpscan.com/vulnerability/0d6b46cb-5244-486f-ad70-4023907ac9eb

Get alerted when CVE-2021-24537 or the next vulnerability affects your stack