CVE-2021-24721: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24721 affects the Loco Translate WordPress plugin versions before 2.5.4. This security flaw was discovered and publicly disclosed on October 11, 2021, by security researcher Tomi Ashari. The vulnerability allows authenticated users with 'translator' role privileges to perform PHP code injection attacks (WPScan).

The vulnerability stems from improper handling of data inputs that are saved to files. The core issue lies in the ability to rename these files to have a .php extension. The vulnerability has been classified as an injection-type vulnerability and received a CVSS score of 8.8 (High). This aligns with the OWASP Top 10 category A1: Injection (WPScan).

When exploited, this vulnerability allows authenticated users with translator privileges to inject PHP code into files with .php extensions in web-accessible locations. This could potentially lead to remote code execution on the affected WordPress installation (CVE Mitre).

The vulnerability has been patched in Loco Translate version 2.5.4. Users are strongly advised to update their Loco Translate plugin to this version or newer to mitigate the risk (WPScan).