PT-2021-15703 · Themeisle · Orbit Fox

Chloe Chamberland · Published 2021-04-05 · Updated 2022-08-30 · CVE-2021-24158

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Orbit Fox by ThemeIsle (affected versions not specified)

Description: The issue concerns a registration form feature in Orbit Fox by ThemeIsle that integrates with Elementor and Beaver Builder page builders. Administrators can set a default user role for new registrations. However, lower-level users can still manipulate the user role parameter to change the default role, despite the field being hidden from their view.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-24158

Affected Products

Orbit Fox

References · 4

• 🔥 https://wordfence.com/blog/2021/01/multiple-vulnerabilities-patched-in-orbit-fox-by-themeisle-plugin · Exploit
• 🔥 https://wpscan.com/vulnerability/d81d0e72-9bb5-47ef-a796-3b305a4b604f · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24158 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24158 · Vendor Advisory