CVE-2021-24222: Williamluis Wp-Curriculo Vitae Free

Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days.

The WP-Curriculo Vitae Free WordPress plugin through 6.3 suffers from an arbitrary file upload issue in page where the [formCadastro] is embed. The form allows unauthenticated user to register and submit files for their profile picture as well as resume, without any file extension restriction, leading to RCE.

Affected products

• Williamluis Wp-Curriculo Vitae Free: up to and including 6.3

Published 2021-04-12. Last modified 2026-06-17.