CVE-2021-25004: SEUR Oficial < 1.7.2 - Admin+ Arbitrary File Download

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-07 · updated 2026-06-17
Weakness: CWE-552

Description

The SEUR Oficial WordPress plugin before 1.7.2 creates a PHP file with a random name when installed, even though it is used for support purposes, it allows to download any file from the web server without restriction after knowing the URL and a password than an administrator can see in the plugin settings page.

Affected products

SEUR Oficial: before 1.7.2 — fixed in 1.7.2

How to fix

Upgrade to a fixed version: SEUR Oficial 1.7.2. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/cfbc2b43-b8f8-4bcb-a3d3-39d217afa530
https://wpscan.com/vulnerability/cfbc2b43-b8f8-4bcb-a3d3-39d217afa530

Get alerted when CVE-2021-25004 or the next vulnerability affects your stack