PT-2021-16023 · WordPress · Workreap

Harald Eilertsen · Published 2021-08-09 · Updated 2021-08-17 · CVE-2021-24501

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Workreap WordPress theme versions prior to 2.2.2

Description The issue concerns missing authorization checks in several AJAX actions, allowing a logged-in user to modify or delete objects belonging to other users on the site. This affects critical operations such as modifying or deleting objects.

Recommendations For versions prior to 2.2.2, update to version 2.2.2 or later to resolve the issue.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-283

CWE-862

Related Identifiers

CVE-2021-24501

Affected Products

Workreap

References · 4

• 🔥 https://wpscan.com/vulnerability/66e4aaf4-5ef7-4da8-a45c-e24f449c363e · Exploit
• 🔥 https://jetpack.com/2021/07/07/multiple-vulnerabilities-in-workreap-theme · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24501 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24501 · Vendor Advisory