CVE-2021-24222: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24222 affects the WordPress plugin WP-Curriculo Vitae Free versions 6.3 and below. This security flaw was discovered and publicly disclosed on March 26, 2021, by security researcher Jin Huang. The vulnerability allows for unauthenticated arbitrary file upload that can lead to Remote Code Execution (RCE) (WPScan).

The vulnerability exists in pages where the shortcode [formCadastro] is embedded. The plugin's registration form allows unauthenticated users to submit files for their profile picture and resume without any file extension restrictions. This lack of proper file validation creates a security gap that can be exploited for remote code execution (GitHub Report).

The vulnerability allows unauthorized users to upload arbitrary files to the server, which can lead to remote code execution. This means attackers could potentially gain control over the affected WordPress installation and execute malicious code on the server (WPScan).

As of the last update, there is no known fix available for this vulnerability. Website administrators using the affected plugin should consider removing or disabling it until a security patch is released (WPScan).