PT-2021-16302 · WordPress · Bp Better Messages

Brandon Roldan + 1 · Published 2021-11-01 · Updated 2021-11-09 · CVE-2021-24809

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: BP Better Messages WordPress plugin versions prior to 1.9.9.41

Description: The issue concerns the lack of CSRF checks in multiple AJAX actions within the plugin. Specifically, the affected actions include bp better messages leave chat, bp better messages join chat, bp messages leave thread, bp messages mute thread, bp messages unmute thread, bp better messages add user to thread, and bp better messages exclude user from thread. This could allow attackers to make logged-in users perform unwanted actions.

Recommendations: For versions prior to 1.9.9.41, update to version 1.9.9.41 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable AJAX actions until a patch is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24809

Affected Products

Bp Better Messages

References · 6

• 🔥 https://wpscan.com/vulnerability/e186fef4-dca0-461f-b539-082c13a68d13 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24809 · Security Note
• https://plugins.trac.wordpress.org/changeset/2605772/bp-better-messages/trunk/inc/ajax.php · Patch
• https://osv.dev/vulnerability/CVE-2021-24809 · Vendor Advisory
• https://t.me/cvenotify/22755 · Telegram Post
• https://t.me/cibsecurity/31529 · Telegram Post