Pular para o conteúdo
Ver todas as ameaças

CVE-2021-24892

Alvo: Não informado

Descrição

Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user’s email address and request for reset password, which could lead to take over of WordPress’s administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress’s user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.

Software
Não informado
Tipo Software
Core
CVE
CVE-2021-24892
Tags
Nâo informado
Data de publicação
23/11/2021
Última atualização
11/03/2022
Pontuação em CVSS 3.0
8.8
Alto
plugins premium WordPress