PT-2021-16029 · WordPress · Astra Pro Addon

Ngoc Nguyen + 1 · Published 2021-08-09 · Updated 2021-08-17 · CVE-2021-24507

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Astra Pro Addon WordPress plugin versions prior to 3.5.2

Description The issue arises from the improper sanitization or escaping of certain POST parameters from the astra pagination infinite and astra shop pagination infinite AJAX actions, which are accessible to both unauthenticated and authenticated users. This leads to SQL injection issues when these parameters are used in SQL statements.

Recommendations For versions prior to 3.5.2, update to version 3.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the astra pagination infinite and astra shop pagination infinite AJAX actions to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-24507

Affected Products

Astra Pro Addon

References · 5

• 🔥 https://wpscan.com/vulnerability/a1a0dc0b-c351-4d46-ac9b-b297ce4d251c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24507 · Security Note
• https://wpastra.com/changelog/astra-pro-addon · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-24507 · Vendor Advisory
• https://t.me/cvenotify/19534 · Telegram Post