PT-2022-9666 · WordPress · Wordpress Admin

Krzysztof Zając · Published 2022-04-25 · Updated 2022-05-03 · CVE-2021-25111

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WordPress Admin WordPress plugin versions prior to 1.5.2

Description The issue arises from the lack of validation of the admin custom language return url before redirecting users to it, resulting in an open redirect issue.

Recommendations For versions prior to 1.5.2, update to version 1.5.2 or later to resolve the issue.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-25111

Affected Products

Wordpress Admin

References · 3

• 🔥 https://wpscan.com/vulnerability/af548fab-96c2-4129-b609-e24aad0b1fc4 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-25111 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25111 · Vendor Advisory