.. / CVE-2021-24215

Exploit for Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation (CVE-2021-24215)

Description:

An Improper Access Control vulnerability was discovered in the plugin. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.

Nuclei Template

View the template here CVE-2021-24215.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24215.yaml
Copy

References:

https://m0ze.ru/vulnerability/%5B2021-03-18%5D-%5BWordPress%5D-%5BCWE-284%5D-Controlled-Admin-Access-WordPress-Plugin-v1.4.0.txt
https://wpscan.com/vulnerability/eec0f29f-a985-4285-8eed-d1855d204a20
https://nvd.nist.gov/vuln/detail/CVE-2021-24215
https://www.opencve.io/cve/CVE-2021-24215
https://m0ze.ru/vulnerability/[2021-03-18]-[WordPress]-[CWE-284]-Controlled-Admin-Access-WordPress-Plugin-v1.4.0.txt