CVE-2021-45807

CriticalCVSS 9.8

Published: 13/01/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.10%

80th percentile - higher than 80% of all known CVEs

Summary

JPress v4.2.0 is vulnerable to remote code execution via the doUploadAndInstall function in the _AddonController. An attacker can upload a malicious file, leading to full server compromise.

Risk Assessment

The risk for the organization includes full server takeover, data theft, and potential lateral movement within the internal network.

Recommendation

Immediately update JPress to the latest version and restrict access to the admin panel to trusted users only.

Original NVD description (English source)

jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.