CVE-2021-21809: Moodle

Critical severity, CVSS 9.1. EPSS: 24.2% chance of exploitation in the next 30 days.

A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.

Affected products

• Moodle Moodle: version 3.10.0 only

Published 2021-06-23. Last modified 2026-06-17.