PT-2022-9493 · WordPress · Stars Rating Wordpress Plugin

Drew Jones · Published 2022-01-03 · Updated 2022-08-30 · CVE-2021-24893

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions The Stars Rating WordPress plugin versions prior to 3.5.1

Description The issue allows submission of a long integer, causing a Denial of Service in the comments section or pending comment dashboard, depending on whether the user sent it as unauthenticated or authenticated. This occurs because the plugin does not validate the submitted rating.

Recommendations For versions prior to 3.5.1, update to version 3.5.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the comments section and pending comment dashboard to minimize the risk of exploitation.

Exploit

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

CVE-2021-24893

Affected Products

Stars Rating Wordpress Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/05d3af69-20b4-499a-8322-2b53674d6a58 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24893 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24893 · Security Note
• https://t.me/cvenotify/35412 · Telegram Post
• https://t.me/cibsecurity/34855 · Telegram Post