PT-2021-15752 · WordPress · Wp Page Builder

Ramuel Gall · Published 2021-04-05 · Updated 2022-07-29 · CVE-2021-24207

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: WP Page Builder versions prior to 1.2.4

Description: The issue allows subscriber-level users to edit and make changes to any and all posts and pages by default, unless user roles are specifically blocked from editing posts and pages.

Recommendations: For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider blocking subscriber-level users from editing posts and pages to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2021-24207

Affected Products

Wp Page Builder

References · 4

• 🔥 https://wpscan.com/vulnerability/21e7a46f-e9a3-4b20-b44a-a5b6ce7b7ce6 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24207 · Vendor Advisory
• https://themeum.com/wp-page-builder-updated-v1-2-4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24207 · Security Note