CVE-2021-24981: 
WordPress vulnerability analysis and mitigation

The Directorist WordPress plugin before version 7.0.6.2 contained a Cross-Site Request Forgery (CSRF) vulnerability that allowed remote file upload, potentially leading to arbitrary PHP shell uploads in the wp-content/plugins directory. The vulnerability was discovered and publicly disclosed on November 16, 2021, and was assigned CVE-2021-24981. This security flaw affected the Directorist Business Directory Plugin, a WordPress plugin used for creating business directories (WPScan).

The vulnerability allowed attackers to exploit a CSRF weakness to upload malicious files to the wp-content/plugins directory. The attack required the victim to be authenticated as any user level. The exploitation process involved creating a specially crafted HTML form that, when submitted, would upload and extract a zip file containing malicious code in the plugins folder, resulting in a PHP shell being placed at 'https://[target-site].com/wp-content/plugins/payload/shell.php' (WPScan).

When exploited, the vulnerability allowed attackers to upload malicious files and potentially gain unauthorized access to the affected WordPress installations. In real-world attacks, the vulnerability was observed being used to deploy fake ransomware infections that would display threatening messages demanding Bitcoin payments. The malware would also modify the database to change post statuses from 'publish' to 'null', making website content inaccessible (Sucuri Blog).

The vulnerability was patched in version 7.0.6.2 of the Directorist plugin. Website administrators are strongly advised to update to this version or later. For affected sites, the immediate mitigation steps include removing the compromised plugin, restoring nulled content in the database using SQL commands, reviewing and removing unauthorized admin users, updating all administrative passwords, and implementing proper website backup procedures (Sucuri Blog).

The security community actively tracked and responded to this vulnerability, with security firms like Sucuri documenting an increase in fake ransomware infections from 6 to 291 cases in a short period. The incident highlighted the importance of proper plugin maintenance and security measures in the WordPress ecosystem (Sucuri Blog).