{"id":"CVE-2021-24966","aliases":["EUVD-2021-11878","GHSA-6x4q-qqxj-h82w"],"status":"published","title":"Error Log Viewer Plugin \u003c= 1.1.1 - Admin+ Arbitrary File Clearing","description":"The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.05188,"percentile":0.92571,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-73"],"published":"2022-03-14T14:41:06Z","modified":"2026-06-17T03:41:12Z","exploits":[{"source":"exploitdb","id":"EDB-50746","title":"WordPress Plugin Error Log Viewer 1.1.1 - Arbitrary File Clearing (Authenticated)","type":"webapps","platform":"php","date":"2022-02-16","url":"https://www.exploit-db.com/exploits/50746"}],"products":[{"vendor":"bestwebsoft","product":"error log viewer by bestwebsoft"},{"vendor":"bestwebsoft","product":"error_log_viewer"},{"vendor":"unknown","product":"error log viewer by bestwebsoft"}],"references":[{"url":"https://wpscan.com/vulnerability/166a4f88-4f0c-4bf4-b624-5e6a02e21fa0","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-24966"},{"url":"https://github.com/advisories/GHSA-6x4q-qqxj-h82w"}],"sources":{"cve":[{"id":"CVE-2021-24966","title":"Error Log Viewer Plugin \u003c= 1.1.1 - Admin+ Arbitrary File Clearing","description":"The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder","status":"published","published":"2022-03-14T14:41:06Z","modified":"2024-08-03T19:49:14.38Z","cwes":["CWE-73"],"updated_at":"2026-11-02T14:33:04.679189Z"}],"euvd":[{"id":"EUVD-2021-11878","description":"The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder","status":"published","published":"2022-03-14T14:41:06Z","modified":"2024-08-03T19:49:14Z","updated_at":"2026-11-03T03:24:54.862767Z"}],"ghsa":[{"id":"GHSA-6x4q-qqxj-h82w","title":"The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to...","description":"The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder","status":"published","published":"2022-03-15T00:00:59Z","modified":"2023-01-27T05:00:41Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:41:44.25061Z"}],"nvd":[{"id":"CVE-2021-24966","description":"The Error Log Viewer WordPress plugin through 1.1.1 does not validate the path of the log file to clear, allowing high privilege users to clear arbitrary files on the web server, including those outside of the blog folder","status":"published","published":"2022-03-14T15:15:08.76Z","modified":"2026-06-17T03:41:12.723Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:07:05.198719Z"}]}}