Vulnerability record · CVE-2021-24370 · published 21 June 2021
CVE-2021-24370: Fancy Product Designer WordPress plugin unauthenticated file upload RCE
Radykal · Fancy Product Designer
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, which leads to remote code execution. Because the endpoint is reachable without credentials, any exposed WordPress site running an affected version is a direct target. The flaw is an unrestricted file upload (CWE-434) with a critical CVSS 3.1 score of 9.8.
Description
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated remote code execution with a 9.8 CVSS score, high EPSS, public exploit code, and reports of active exploitation make this an urgent patch.
What it is
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, which leads to remote code execution. Because the endpoint is reachable without credentials, any exposed WordPress site running an affected version is a direct target. The flaw is an unrestricted file upload (CWE-434) with a critical CVSS 3.1 score of 9.8.
Impact
An attacker can upload and execute arbitrary code on the web server, gaining full control of the WordPress host and its data. This typically enables site takeover, data theft, and use of the server as a foothold for further attacks.
Attack surface
Reached over the network via the plugin's file upload functionality; the CVSS vector (AV:N/AC:L/PR:N/UI:N) and description confirm no authentication and no user interaction are required. Any internet-facing WordPress installation with the vulnerable plugin is exposed.
Exploitation
Not listed in CISA KEV, but EPSS is 0.47371 (98.8th percentile) and multiple references are tagged Exploit, including reports of active exploitation in the wild. Exploit code and public reporting are available.
What to do
- Update Fancy Product Designer to version 4.6.9 or later immediately.
- If patching is not possible, disable or remove the plugin until it can be updated.
- Restrict file upload endpoints with a WAF rule blocking executable file types (PHP, phtml, etc.).
- Enforce WordPress file permissions so the web server cannot execute uploaded files in upload directories.
- Audit the site for webshells and unexpected files after any exposure window.
Detection
- Monitor web server and plugin upload directories for newly created PHP or executable files.
- Alert on POST requests to Fancy Product Designer upload endpoints from unauthenticated clients.
- Review logs for requests matching known exploit paths or payloads from the public references.
- Scan the filesystem for webshell indicators and unexpected process execution by the web server user.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-24370 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-24370), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
