PT-2021-15737 · WordPress · Wp Maintenance Mode & Site Under Construction

Bugbang · Published 2021-05-14 · Updated 2022-07-30 · CVE-2021-24191

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WP Maintenance Mode & Site Under Construction WordPress plugin versions prior to 1.8.2

Description: The issue allows low-privileged users to install any plugin, including specific versions, from the WordPress repository and activate arbitrary plugins from the blog. This can be achieved by utilizing the AJAX action cp plugins do button job later callback. The exploitation of this issue could lead to the installation of vulnerable plugins, potentially resulting in more critical vulnerabilities, such as remote code execution (RCE).

Recommendations: For WP Maintenance Mode & Site Under Construction WordPress plugin versions prior to 1.8.2, update to version 1.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the cp plugins do button job later callback AJAX action until a patch is applied.

Exploit

Fix

RCE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2021-24191

Affected Products

Wp Maintenance Mode & Site Under Construction

References · 5

• 🔥 https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c · Exploit
• https://osv.dev/vulnerability/CVE-2021-24191 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24191 · Security Note
• https://t.me/cvenotify/14435 · Telegram Post
• https://t.me/cvenotify/34049 · Telegram Post