CVE-2021-24370
Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
- Record
CVE-2021-24370- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
CVE List No score
Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
- Record
CVE-2021-24370- Weakness
- CWE-434
- Updated
- 2026-11-02
EUVDEUVD-2021-11283 No score
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
- Record
EUVD-2021-11283- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x5g3-h6vq-mcw4
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to...
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
- Record
GHSA-x5g3-h6vq-mcw4- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | WordPress Fancy Product Designer <4.6.9 - Arbitrary File Upload |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-24370 is a critical vulnerability (CVSS 9.8) in Radykal Fancy Product Designer, published June 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 47.4%, the 98th percentile. No source names a fixed version.
References
wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38
wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack
lists.openwall.net/full-disclosure/2020/11/17/2
seclists.org/fulldisclosure/2020/Nov/30
secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin
nvd.nist.gov/vuln/detail/CVE-2021-24370
github.com/advisories/GHSA-x5g3-h6vq-mcw4