CVE-2021-24253: Classyfrieds Project Classyfrieds

High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days.

The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.

Affected products

• Classyfrieds Project Classyfrieds: up to and including 3.8

Published 2021-05-06. Last modified 2026-06-17.