CVE-2021-24240: Aivahthemes Business Hours Pro

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

The Business Hours Pro WordPress plugin through 5.5.0 allows a remote attacker to upload arbitrary files using its manual update functionality, leading to an unauthenticated remote code execution vulnerability.

Affected products

• Aivahthemes Business Hours Pro: up to and including 5.5.0

Published 2021-04-22. Last modified 2026-06-17.