CVE-2021-24981

The Directorist plugin before version 7.0.6.2 contained a cross-site request forgery flaw that allowed attackers to upload arbitrary files, including malicious PHP shells, to the wp-content/plugins directory. This vulnerability was actively exploited in the wild by malicious actors to deploy ransomware. The lack of proper request verification made it possible for attackers to trick administrators into performing unintended file uploads that could lead to complete site compromise.

Based on public CVE data (MITRE/NVD).