PT-2021-16298 · WordPress · Simple Jwt Login

Apple502J · Published 2021-11-17 · Updated 2021-11-19 · CVE-2021-24804

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Simple JWT Login WordPress plugin versions prior to 3.2.1

Description: The issue allows attackers to modify the plugin's settings without proper validation, potentially leading to site takeover. Settings that can be updated include the HMAC verification secret, account registering, and default user roles.

Recommendations: For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the settings page to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24804

Affected Products

Simple Jwt Login

References · 3

• 🔥 https://wpscan.com/vulnerability/6f015e8e-462b-4ef7-a9a1-bb91e7d28e37 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24804 · Security Note