CVE-2021-24375

Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the Motor WordPress theme before 3.1.0 allows an unauthenticated attacker access to arbitrary files in the server file system, and to execute arbitrary php scripts found on the server file system. We found no vulnerability for uploading files with this theme, so any scripts to be executed must already be on the server file system.

• CWE-22

• https://jetpack.com/2021/06/09/motor-wordpress-theme-vulnerabilities/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/d9518429-79d3-4b13-88ff-3722d05efa9fExploit, Third Party Advisory
• https://jetpack.com/2021/06/09/motor-wordpress-theme-vulnerabilities/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/d9518429-79d3-4b13-88ff-3722d05efa9fExploit, Third Party Advisory

Published

Jul 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2437Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-24370The Fancy Product Designer WordPress plugin before 4.6.9 all…9.8
• CVE-2021-24371The Import feature of the RSVPMaker WordPress plugin before …2.7
• CVE-2021-24372The WP Hardening – Fix Your WordPress Security WordPress plu…6.1
• CVE-2021-24373The WP Hardening – Fix Your WordPress Security WordPress plu…6.1
• CVE-2021-24374The Jetpack Carousel module of the JetPack WordPress plugin …5.3
• CVE-2021-24376The Autoptimize WordPress plugin before 2.7.8 attempts to de…9.8
• CVE-2021-24377The Autoptimize WordPress plugin before 2.7.8 attempts to re…8.1
• CVE-2021-24378The Autoptimize WordPress plugin before 2.7.8 does not check…4.8
• CVE-2021-24379The Comments Like Dislike WordPress plugin before 1.1.4 allo…5.3
• CVE-2021-2438Vulnerability in the Java VM component of Oracle Database Se…4.3
• CVE-2021-24380The Shantz WordPress QOTD WordPress plugin through 1.2.2 is …4.3