The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42 | Exploit Third Party Advisory |
https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:53
Type | Values Removed | Values Added |
---|---|---|
References | () https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42 - Exploit, Third Party Advisory |
Information
Published : 2022-02-28 09:15
Updated : 2024-11-21 05:53
NVD link : CVE-2021-24803
Mitre link : CVE-2021-24803
CVE.ORG link : CVE-2021-24803
JSON object : View
Products Affected
core_tweaks_wp_setup_project
- core_tweaks_wp_setup
CWE
CWE-352
Cross-Site Request Forgery (CSRF)