← Vulnerability feed

Vulnerability record · CVE-2021-24966 · published 14 March 2022

CVE-2021-24966: Bestwebsoft error log viewer vulnerability

Bestwebsoft · Error Log Viewer

The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder

4.9 CVSS 3.1 Medium EPSS 5.2% · top 7.8% CWE-73 · CWE-73
4.9CVSS 3.1 base score, v2 4.0
5.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://wpscan.com/vulnerability/166a4f88-4f0c-4bf4-b624-5e6a02e21fa0 ExploitThird Party Advisory
https://wpscan.com/vulnerability/166a4f88-4f0c-4bf4-b624-5e6a02e21fa0 ExploitThird Party Advisory

Track CVE-2021-24966 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.5CVE-2023-6821Bestwebsoft error log viewer missing authorization vulnerabilityThe Error Log Viewer by BestWebSoft WordPress plugin before 1.1.3 is affected by a Directory Listing issue, allowing users to read and download PHP l…EPSS 0.59%6.5CVE-2021-24761Bestwebsoft error log viewer path traversal vulnerabilityThe Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention,…EPSS 0.60%6.1CVE-2017-18562Bestwebsoft error log viewer cross-site scripting vulnerabilityThe error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.EPSS 1.4%6.1CVE-2017-2171Bestwebsoft captcha cross-site scripting vulnerabilityCross-site scripting vulnerability in Captcha prior to version 4.3.0, Car Rental prior to version 1.0.5, Contact Form Multi prior to version 1.2.1, C…EPSS 0.89%8.8CVE-2025-33053Microsoft Windows WebDAV Internet Shortcut File Path Control RCEWindows Internet Shortcut (.url) files allow external control of a file name or path, which an unauthorized attacker can abuse to execute code over a…KEVEPSS 87%analysed5.4CVE-2025-24054Windows NTLM file path control allows spoofingWindows NTLM mishandles externally controlled file names or paths, letting an unauthorized attacker perform spoofing over a network. The flaw affects…KEVEPSS 59%analysed7.1CVE-2025-0111PAN-OS authenticated file read via management web interfacePAN-OS contains an authenticated file read vulnerability that lets a user with network access to the management web interface read files on the PAN-O…KEVEPSS 2.0%analysed6.5CVE-2024-43451Microsoft Windows NTLMv2 hash disclosure via spoofingCVE-2024-43451 is an NTLM hash disclosure spoofing vulnerability in Microsoft Windows. An attacker can induce a victim to disclose their NTLMv2 hash,…KEVEPSS 84%analysed

Source: NIST National Vulnerability Database (record CVE-2021-24966), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.