CVE-2021-42362: The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attack

high Affects wordpress-popular-posts (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2021-11-17; advisory modified 2026-06-17.

The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attack

Package: wordpress-popular-posts (WordPress plugin) WordPress
Affected versions: <=5.3.2
Fixed in: no fix recorded
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 80% (99.6th percentile)
Published: 2021-11-17
Source: nvd

References

CWE-434

NVD record wordpress-popular-posts (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-20746 medium Cross-site scripting vulnerability in WordPress Popular Posts 5.3.2 and earlier allows a r same package: wordpress-popular-posts (WordPress plugin)
CVE-2022-43468 high External initialization of trusted variables or data stores vulnerability exists in WordPr same package: wordpress-popular-posts (WordPress plugin)
CVE-2021-36872 medium Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in WordPress Popular Pos same package: wordpress-popular-posts (WordPress plugin)
CVE-2023-45607 medium Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera Wor same package: wordpress-popular-posts (WordPress plugin)
CVE-2020-25213 KEV critical Unauthenticated arbitrary file upload to RCE via the elFinder connector same weakness: CWE-434
CVE-2020-35489 KEV critical Unrestricted file upload via unsanitised filenames (double extension) same weakness: CWE-434