CVE-2021-24370
📋 TL;DR
The Fancy Product Designer WordPress plugin before version 4.6.9 contains an unauthenticated arbitrary file upload vulnerability. This allows attackers to upload malicious files, including PHP shells, leading to remote code execution on affected WordPress sites. Any WordPress installation using vulnerable versions of this plugin is affected.
💻 Affected Systems
- Fancy Product Designer WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise: attacker gains full control of the WordPress site, can execute arbitrary commands, steal data, install backdoors, and pivot to other systems.
Likely Case
Website defacement, data theft, malware distribution, or cryptomining installation through uploaded web shells.
If Mitigated
Attack blocked at web application firewall level or detected before exploitation completes.
🎯 Exploit Status
Active exploitation was observed in the wild. Exploit scripts are publicly available and easy to use.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.6.9
Vendor Advisory: https://wordpress.org/plugins/fancy-product-designer/#developers
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Fancy Product Designer. 4. Click 'Update Now' if available. 5. If not, download version 4.6.9+ from WordPress.org and manually update.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily deactivate the vulnerable plugin until patching is possible.
wp plugin deactivate fancy-product-designer
Web Application Firewall Rule
allBlock requests to the vulnerable upload endpoint.
Block POST requests to /wp-content/plugins/fancy-product-designer/
🧯 If You Can't Patch
- Remove the plugin entirely if not needed
- Implement strict file upload restrictions at server level
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Fancy Product Designer version. If version < 4.6.9, vulnerable.Check Version:
wp plugin get fancy-product-designer --field=versionVerify Fix Applied:
Confirm plugin version is 4.6.9 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-content/plugins/fancy-product-designer/ with file upload parameters
- Unexpected .php files in upload directories
- Web shell activity patterns
Network Indicators:
- Unusual outbound connections from WordPress server
- File uploads to plugin endpoint from unexpected sources
SIEM Query:
source="web_logs" AND uri_path="/wp-content/plugins/fancy-product-designer/" AND http_method="POST" AND status_code=200🔗 References
- https://lists.openwall.net/full-disclosure/2020/11/17/2
- https://seclists.org/fulldisclosure/2020/Nov/30
- https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38
- https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/
- https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/
- https://lists.openwall.net/full-disclosure/2020/11/17/2
- https://seclists.org/fulldisclosure/2020/Nov/30
- https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38
- https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/
- https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/
