WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload
Priority HIGH 78CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.
Why it matters now
EPSS 0.79823 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| WordPress Popular Posts | WordPress Popular Posts | 0.0 – 5.3.2 | — | No fix listed | CNA |
- WordPress Popular Posts VendorWordPress Popular Posts Affected 0.0 – 5.3.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wordpress_popular_posts_project:wordpress_popular_posts:*:*:*:*:*:wordpress:*:* | up to 5.3.2 | Vulnerable | Hector Cabrera |
- cpe:2.3:a:wordpress_popular_posts_project:wordpress_popular_posts:*:*:*:*:*:wordpress:*:* Versions up to 5.3.2 Vulnerable ·Hector Cabrera
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42362
- 2026-10-03 Alias added: GHSA-p9wv-phc4-8hqf
References
Exploit 2
Patch 2
More Hector Cabrera Wordpress Popular Posts vulnerabilities
- TI-2022-21260 External initialization of trusted variables or data stores vulnerability exists in… CVSS 3.1HIGH 7.5
- TI-2023-24410 WordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS) CVSS 3.1MEDIUM 6.5
- TI-2021-03972 Cross-site scripting in Hector Cabrera WordPress Popular Posts CVSS 3.1MEDIUM 5.4
- TI-2021-14964 WordPress Popular Posts plugin <= 5.3.3 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-42362 · CVE Program
- CVE-2021-42362 · NVD
- FIRST EPSS
- GHSA-p9wv-phc4-8hqf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences