CVE-2021-24252: 
WordPress vulnerability analysis and mitigation

The Event Banner WordPress plugin through version 1.3 contains an arbitrary file upload vulnerability (CVE-2021-24252) that was discovered by Jin Huang and publicly disclosed on April 10, 2021. The vulnerability affects the free-event-banner plugin and has no known fix (WPScan).

The vulnerability stems from the plugin's failure to verify uploaded image files, which allows administrator accounts to upload arbitrary files including executable files like .php or .exe. Additionally, the plugin lacks CSRF protection and proper authorization checks, making it vulnerable to Local File Inclusion (LFI) attacks when WordPress is loaded (WPScan).

When successfully exploited, this vulnerability can lead to Remote Code Execution (RCE) on the affected WordPress installation. An attacker with administrative access can upload malicious files to the server, potentially gaining complete control over the website (WPScan).

The vulnerability can be exploited through the WordPress admin interface at /wp-admin/admin.php?page=free_event_banner. Uploaded malicious files are stored in the wp-content/uploads/event_banner/ directory. The exploit can be triggered either through direct file upload or via CSRF attack (WPScan).

As there is no known fix for this vulnerability, the recommended mitigation is to uninstall the Event Banner plugin from WordPress installations (WPScan).