CVE-2021-24236

The Imagements WordPress plugin through 1.2.5 allows images to be uploaded in comments, however only checks for the Content-Type in the request to forbid dangerous files. This allows unauthenticated attackers to upload arbitrary files by using a valid image Content-Type along with a PHP filename and code, leading to RCE.

Date published : 2021-05-05

https://wpscan.com/vulnerability/8f24e74f-60e3-4100-9ab2-ec31b9c9cdea