Medium severity6.5NVD Advisory· Published Nov 8, 2021· Updated Jun 17, 2026

CVE-2021-24721

Description

The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated "translator" users being able to inject PHP code into files ending with .php in web accessible locations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Loco Translatellm-fuzzy2 versions
<2.5.4+ 1 more
- (no CPE)range: <2.5.4
- (no CPE)range: 2.5.4
Package: https://wordpress.org/plugins/loco-translate

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/bc7d4774-fce8-4b0b-8015-8ef4c5b02d38nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000