PT-2021-15774 · WordPress · Patreon Wordpress Plugin

Benedict Singer + 4 · Published 2021-04-12 · Updated 2021-05-04 · CVE-2021-24230

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Patreon WordPress plugin versions prior to 1.7.0

Description: A Cross-Site Request Forgery issue allows attackers to make a logged-in user overwrite or create arbitrary user metadata on the victim's account. This can be used to overwrite the wp capabilities meta, which contains the affected user account's roles and privileges, potentially locking them out of the site and blocking access to paid content.

Recommendations: For versions prior to 1.7.0, update to version 1.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive user metadata to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24230

Affected Products

Patreon Wordpress Plugin

References · 4

• 🔥 https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24230 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24230 · Vendor Advisory
• https://wpscan.com/vulnerability/2deefa2d-3043-42e5-afef-a42c37703531 · Note