PT-2021-16308 · WordPress · Phoenix Media Rename

Apple502J · Published 2021-11-08 · Updated 2021-11-09 · CVE-2021-24816

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Phoenix Media Rename WordPress plugin versions prior to 3.4.4

Description: The issue is related to the lack of capability checks in the phoenix media rename AJAX action. This could allow users with Author roles to rename any uploaded media files, including ones they do not own.

Recommendations: For versions prior to 3.4.4, update to version 3.4.4 or later to resolve the issue. As a temporary workaround, consider restricting the phoenix media rename AJAX action to only allow users with appropriate permissions to rename media files.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-24816

Affected Products

Phoenix Media Rename

References · 5

• 🔥 https://wpscan.com/vulnerability/5f63d677-20f3-4fe0-bb90-048b6898e6cd · Exploit
• https://osv.dev/vulnerability/CVE-2021-24816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24816 · Security Note
• https://t.me/cvenotify/23132 · Telegram Post
• https://t.me/cibsecurity/31990 · Telegram Post