PT-2021-16151 · WordPress · Visual Link Preview

Apple502J · Published 2021-09-20 · Updated 2022-10-25 · CVE-2021-24635

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Visual Link Preview WordPress plugin versions prior to 2.2.3

Description The issue allows any authenticated user to call several AJAX actions without proper authorization, due to the CSRF nonce being displayed for all authenticated users. This enables users to perform certain actions, including:

• Getting and searching through the title and content of draft posts
• Getting the title of a password-protected post
• Uploading an image from a URL

Recommendations For versions prior to 2.2.3, update to version 2.2.3 or later to resolve the issue.

Exploit

Fix

Improper Access Control

Missing Authorization

Weakness Enumeration

CWE-284

CWE-862

Related Identifiers

CVE-2021-24635

Affected Products

Visual Link Preview

References · 4

• 🔥 https://wpscan.com/vulnerability/854b23d9-e3f8-4835-8d29-140c580f11c9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24635 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24635 · Vendor Advisory
• https://t.me/cvenotify/21144 · Telegram Post