PT-2021-16228 · WordPress · Comment Link Remove/Other Comment Tools

Martin Vierula · Published 2021-09-13 · Updated 2021-09-23 · CVE-2021-24725

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Comment Link Remove and Other Comment Tools WordPress plugin versions prior to 2.1.6

Description The issue concerns the lack of a CSRF check in the 'Delete comments easily' feature, which could allow attackers to trick logged-in admins into deleting arbitrary comments.

Recommendations For versions prior to 2.1.6, update to version 2.1.6 or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24725

Affected Products

Comment Link Remove/Other Comment Tools

References · 4

• 🔥 https://wpscan.com/vulnerability/01483284-57f5-4ae9-b5f1-ae26b623571f · Exploit
• 🔥 https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=29225 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24725 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24725 · Security Note