PT-2023-12469 · WordPress · Controlled Admin Access

Jerome Bruandet · CVE-2021-4360 · Publicado 2023-06-07 · Atualizado 2023-06-13

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Controlled Admin Access plugin for WordPress versions up to, and including, 1.5.5

Description The issue allows for Privilege Escalation by not properly restricting access to the configuration page, making it possible for attackers to create a new administrator role with unrestricted access.

Recommendations For versions up to, and including, 1.5.5, update to a version that properly restricts access to the configuration page to prevent Privilege Escalation.

Exploit

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2021-4360

Produtos afetados

Controlled Admin Access

Referências · 6

• 🔥 https://wpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379c · Exploit
• 🔥 https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-4360 · Nota de Segurança
• https://plugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txt · Nota
• https://osv.dev/vulnerability/CVE-2021-4360 · Aviso do Fabricante
• https://wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=cve · Nota