PT-2021-15781 · WordPress · Realteo Wordpress Plugin

M0Ze + 1 · Published 2021-04-22 · Updated 2022-07-29 · CVE-2021-24238

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Realteo WordPress plugin versions prior to 1.2.4

Description The issue allows any authenticated users to delete arbitrary properties by tampering with the property id parameter, as the plugin does not ensure that the requested property to be deleted belongs to the user making the request.

Recommendations For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the property deletion functionality to minimize the risk of exploitation. Avoid using the property id parameter in affected API endpoints until the issue is resolved.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-425

CWE-284

Related Identifiers

CVE-2021-24238

Affected Products

Realteo Wordpress Plugin

References · 8

• 🔥 https://wpscan.com/vulnerability/b8434eb2-f522-484f-9227-5f581e7f48a5 · Exploit
• 🔥 https://m0ze.ru/vulnerability/[2021-03-20]-[WordPress]-[CWE-284]-Findeo-WordPress-Theme-v1.3.0.txt · Exploit
• 🔥 https://m0ze.ru/vulnerability/[2021-03-20]-[WordPress]-[CWE-284]-Realteo-WordPress-Plugin-v1.2.3.txt · Exploit
• https://docs.purethemes.net/findeo/knowledge-base/changelog-findeo · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-24238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24238 · Security Note
• https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Realteo-WordPress-Plugin-v1.2.3.txt · Note
• https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Findeo-WordPress-Theme-v1.3.0.txt · Note