TI-2021-06966 Aliases CVE-2021-24684 GHSA-25m3-pw7x-34hv

PDF Light Viewer < 1.4.12 - Authenticated Command Injection

MEDIUM 45CWE-78Published 2021-10-18 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.

Why it matters now

EPSS 0.04267 91st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed WordPress PDF Light Viewer Plugin (Unknown): 1.4.12

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	WordPress PDF Light Viewer Plugin	1.4.12 to before 1.4.12	1.4.12	Patch available	CNA

WordPress PDF Light Viewer Plugin VendorUnknown Affected 1.4.12 to before 1.4.12 Fixed in 1.4.12 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:teamlead:pdf-light-viewer::::::wordpress::*	before 1.4.12	Vulnerable	Teamlead

cpe:2.3:a:teamlead:pdf-light-viewer:*:*:*:*:*:wordpress:*:* Versions before 1.4.12 Vulnerable ·Teamlead

Remediation

Fix · CNA WordPress PDF Light Viewer Plugin (Unknown) Fixed in 1.4.12

Timeline

2026-10-02 Threatist record created from CVE-2021-24684
2026-10-03 Alias added: GHSA-25m3-pw7x-34hv

References

Exploit 1

https://wpscan.com/vulnerability/b5295bf9-8cf6-416e-b215-074742a5fc63

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences