CVE-2021-24155

CVE-2021-24155 describes an arbitrary file upload vulnerability in the WordPress Backup and Migrate Plugin – Backup Guard, affecting versions prior to 1.6.0. This flaw allows authenticated high-privilege users (administrators) to upload non-SGBP formatted files, including malicious PHP files, leading to Remote Code Execution (RCE). With a CVSS score of 7.2 (High) and an EPSS score of 0.93119, the vulnerability is easily exploitable over the network with low attack complexity, posing a significant risk of complete compromise (confidentiality, integrity, availability). While not on the KEV catalog, exploit intelligence indicates readily available public exploit code, including Metasploit modules and Nuclei templates, suggesting a high likelihood of exploitation. Despite this, there is minimal community discussion or media coverage surrounding this CVE.