Skip to content
Fencer Vulns
high 8.8

CVE-2021-42362 in the critical feed json

WordPress Popular Posts <= 5.3.2 Authenticated Arbitrary File Upload

published 2021-11-17 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-29333

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
79.8%
EPSS 79.8% chance of exploitation in 30 days, percentile 99.6%
public exploits
2
Metasploit, Exploit-DB

Summary

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.

Patch / fix

Timeline

  1. First public exploit (Metasploit exploit/multi/http/wp_popular_posts_rce)
  2. Published

Exploit prediction

79.82% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/multi/http/wp_popular_posts_rce Wordpress Popular Posts Authenticated RCE metasploit exploit, normal rank, 2021-06-11
  • EDB-50129 WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution (RCE) (Authenticated) webapps, 2021-07-15
  • blog.nintechnet.com https://blog.nintechnet.com/improper-input-validation-fixed-in-wordpress-popular-posts-plugin/ referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/165376/WordPress-Popular-Posts-5.3.2-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • WordPress Popular Posts WordPress Popular Posts

Classification

Weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.