CVE-2021-4225

The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.

• CWE-434

• https://github.com/pang0lin/CVEproject/blob/main/wordpress_SP-Project_fileupload.mdExploit, Third Party Advisory
• https://wpscan.com/vulnerability/bd1083d1-edcc-482e-a8a9-c8b6c8d417bdExploit, Third Party Advisory
• https://github.com/pang0lin/CVEproject/blob/main/wordpress_SP-Project_fileupload.mdExploit, Third Party Advisory
• https://wpscan.com/vulnerability/bd1083d1-edcc-482e-a8a9-c8b6c8d417bdExploit, Third Party Advisory

Published

Apr 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42235SQL injection in osTicket before 1.14.8 and 1.15.4 login and…9.8
• CVE-2021-42237Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 …9.8
• CVE-2021-42242A command execution vulnerability exists in jfinal_cms 5.0.1…9.8
• CVE-2021-42244A cross-site scripting (XSS) vulnerability in PaquitoSoftwar…6.1
• CVE-2021-42245FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerab…6.1
• CVE-2021-42248Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-42250Improper output neutralization for Logs. A specific Apache S…6.5
• CVE-2021-42252An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/s…7.8
• CVE-2021-42254BeyondTrust Privilege Management prior to version 21.6 creat…7.8
• CVE-2021-42255AppGuard Enterprise before 6.7.100.1 creates a Temporary Fil…7.8
• CVE-2021-42257check_smart before 6.9.1 allows unintended drive access by a…7.1
• CVE-2021-42258BQE BillQuick Web Suite 2018 through 2021 before 22.0.9.1 al…9.8