CVE-2021-24770: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24770 affects the WordPress plugin Stylish Price List versions prior to 6.9.1. The vulnerability was discovered and publicly disclosed on September 29, 2021. It involves an incorrect authorization issue in the plugin's image upload functionality (WPScan).

The vulnerability stems from missing capability checks in the plugin's spl_upload_ser_img AJAX action, which is accessible to authenticated users. This security flaw is classified as an Incorrect Authorization (CWE-863) and falls under the OWASP Top 10 category A5: Broken Access Control. The vulnerability has been assigned a CVSS score of 4.3 (medium severity) (WPScan).

The vulnerability allows any authenticated user, including those with minimal privileges such as subscribers, to upload arbitrary images to the WordPress installation's upload directory. The uploaded files are stored in the wp-content/uploads directory and are publicly accessible (WPScan).

The vulnerability has been fixed in version 6.9.1 of the Stylish Price List plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).