CVE-2021-24224
Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
- Record
CVE-2021-24224- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
- Record
CVE-2021-24224- Weakness
- CWE-434
- Updated
- 2026-11-02
EUVDEUVD-2021-11138 No score
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
- Record
EUVD-2021-11138- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hv6f-36rr-r48j No score
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0,...
The EFBP_verify_upload_file AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE.
- Record
GHSA-hv6f-36rr-r48j- Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-24224 is a high vulnerability (CVSS 8.8) in Hassantafreshi Easy Form Builder, published April 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. No source names a fixed version.