CVE-2021-24222

Name of the Vulnerable Software and Affected Versions: WP-Curriculo Vitae Free WordPress plugin versions 6.3 and earlier

Description: The issue allows unauthenticated users to upload arbitrary files, including those that can lead to remote code execution (RCE), due to a lack of file extension restrictions in the profile picture and resume submission form. This form is embedded in a page using the [formCadastro] shortcode.

Recommendations: For WP-Curriculo Vitae Free WordPress plugin versions 6.3 and earlier, consider disabling the file upload feature in the [formCadastro] form until a patch is available. Restrict access to the form to minimize the risk of exploitation. Avoid using the file upload feature for profile pictures and resumes until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.