WordPress Plugin Vulnerabilities

Envato Elements < 2.0.11 - Contributor+ Arbitrary File Upload

Description

The plugin does not properly check extracted uploaded archive files, allowing contributors and above roles to upload malicious templates containing PHP files

Affects Plugins

Plugin icon
envato-elements
Fixed in 2.0.11

References

CVE
CVE-2021-4330

Miscellaneous

Original Researcher
Chloe Chamberland
Verified
No
WPVDB ID
5a3a51d5-7823-4db8-bd9b-29519ff610c7

Timeline

Publicly Published
2021-10-21 (about 4 years ago)
Added
2023-03-07 (about 3 years ago)
Last Updated
2023-03-07 (about 3 years ago)

Other

Published
Title
Published
2025-08-04
Title
WP Import Export Lite < 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2014-08-01
Title
The Cotton - Remote File Upload
Published
2024-12-11
Title
Opt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload
Published
2023-12-05
Title
Symbiostock Lite <= 6.0.0 - Authenticated (Shop Manager+) Arbitrary File Upload
Published
2014-08-01
Title
felici - Custom Background Shell Upload