CVE-2021-24223: 
WordPress vulnerability analysis and mitigation

The N5 Upload Form WordPress plugin through version 1.0 contains an unauthenticated arbitrary file upload vulnerability (CVE-2021-24223). This vulnerability was discovered by Jin Huang and publicly disclosed on March 26, 2021. The plugin allows remote attackers to upload arbitrary executable files to the server, potentially leading to remote code execution (WPScan).

The vulnerability exists in pages where a Form from the plugin is embedded, allowing unrestricted file uploads. While the uploaded filename is generated using md5(uniqid(rand())) making it harder to guess, servers with Directory listing enabled make accessing the uploaded files trivial. The plugin uses the moveuploadedfile() function to store files in a user-specified directory but fails to implement proper file extension restrictions or directory access controls (GitHub Report). The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) (Qualys Report).

The vulnerability allows remote attackers to upload arbitrary executable files to the server, potentially leading to remote code execution. This could result in complete system compromise, as attackers could execute malicious code on the affected server (WPScan).

No official fix has been released for this vulnerability. Website administrators using the N5 Upload Form plugin should remove or disable it until a security patch is available (WPScan).