PT-2021-16299 · WordPress · Wpdiscuz

Brandon Roldan + 1 · Published 2021-11-08 · Updated 2021-11-09 · CVE-2021-24806

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: wpDiscuz WordPress plugin versions prior to 7.3.4

Description: The issue allows attackers to make logged-in users, such as admins, edit and delete arbitrary comments, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged-in users post arbitrary comments. This is due to the plugin not checking for CSRF when adding, editing, and deleting comments.

Recommendations: For versions prior to 7.3.4, update to version 7.3.4 or later to resolve the issue. As a temporary workaround, consider implementing additional CSRF protection measures to prevent exploitation. Restrict access to comment editing and deletion functionality to minimize the risk of exploitation. Avoid using the plugin's comment functionality until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24806

Affected Products

Wpdiscuz

References · 5

• 🔥 https://wpscan.com/vulnerability/2746101e-e993-42b9-bd6f-dfd5544fa3fe · Exploit
• https://osv.dev/vulnerability/CVE-2021-24806 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24806 · Security Note
• https://t.me/cibsecurity/31993 · Telegram Post
• https://t.me/cvenotify/23134 · Telegram Post