PT-2022-9478 · WordPress · Tab

Brandon Roldan + 1 · Published 2022-01-03 · Updated 2023-08-31 · CVE-2021-24831

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Tab WordPress plugin versions prior to 1.3.2

Description The issue allows unauthenticated attackers to modify various data in the plugin, such as add, edit, or delete arbitrary tabs, because all AJAX actions of the Tab WordPress plugin are available to both unauthenticated and authenticated users.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to AJAX actions in the plugin to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-425

CWE-862

Related Identifiers

CVE-2021-24831

Affected Products

Tab

References · 6

• 🔥 https://wpscan.com/vulnerability/75ed9f5f-e091-4372-a6cb-57958ad5f900 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24831 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24831 · Security Note
• https://t.me/cibsecurity/34856 · Telegram Post
• https://t.me/cvenotify/26578 · Telegram Post
• https://t.me/cvenotify/25817 · Telegram Post