Is CVE-2021-24499 actively exploited?

Yes. CVE-2021-24499 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2021-24499 be exploited remotely?

The attack vector of CVE-2021-24499 has not been classified yet.

What is the CVSS score of CVE-2021-24499?

CVE-2021-24499 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2021-24499

UNKNOWNCISA KEVIN THE WILD

CVE-2021-24499

Published: April 11, 2026

EPSS:93.94%probability of exploitation in 30 daysPercentile:99.9th

Official Description

The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.

NVD Source

Technical Analysis

CVE-2021-24499 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2021-24499 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.