exploitDog

CVE-2021-24803

Опубликовано: 28 фев. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks

Ссылки

https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42
Exploit
Third Party Advisory
https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:core_tweaks_wp_setup_project:core_tweaks_wp_setup:*:*:*:*:*:wordpress:*:*

Версия до 4.1 (включая)

EPSS

Процентиль: 30%

0.00109

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-cjg4-c2hx-54x2

github

почти 4 года назад

The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks

EPSS

Процентиль: 30%

0.00109

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-352