Researchers
Back
Tomi Ashari
#47432
of 60,401
6.5
Total CVSS
Vulnerabilities
·
1
PT-2021-16224
2021-11-08
6.5
CVE-2021-24721
WordPress
Loco Translate
The issue concerns the mishandling of data inputs that get saved to a file, which can be renamed to have a .php extension. This allows authenticated "translator" users to inject PHP code into files ending with .php in web-accessible locations.