PT-2023-12469 · WordPress · Controlled Admin Access

Jerome Bruandet · Published 2023-06-07 · Updated 2023-06-13 · CVE-2021-4360

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Controlled Admin Access plugin for WordPress versions up to, and including, 1.5.5

Description The issue allows for Privilege Escalation by not properly restricting access to the configuration page, making it possible for attackers to create a new administrator role with unrestricted access.

Recommendations For versions up to, and including, 1.5.5, update to a version that properly restricts access to the configuration page to prevent Privilege Escalation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-4360

Affected Products

Controlled Admin Access

References · 6

• 🔥 https://wpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379c · Exploit
• 🔥 https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-4360 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4360 · Vendor Advisory
• https://plugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txt · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=cve · Note