PT-2021-16089 · WordPress · Accept Donations With Paypal

Dc11 · Published 2021-11-01 · Updated 2021-11-03 · CVE-2021-24572

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Accept Donations with PayPal WordPress plugin versions prior to 1.3.1

Description The issue arises from the lack of CSRF protection when deleting donation buttons, which are stored as posts. This allows an attacker to trick logged-in admins into deleting arbitrary posts, as there is no check to verify if the deleted post was a button post.

Recommendations For versions prior to 1.3.1, update to version 1.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the post deletion functionality to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24572

Affected Products

Accept Donations With Paypal

References · 5

• 🔥 https://wpscan.com/vulnerability/7b1ebd26-ea8b-448c-a775-66a04102e44f · Exploit
• https://osv.dev/vulnerability/CVE-2021-24572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24572 · Security Note
• https://t.me/cibsecurity/31527 · Telegram Post
• https://t.me/cvenotify/22774 · Telegram Post