Vulnerability record/PUBLISHED/Published Feb 28, 2022 09:06:09 UTC
CVE-2021-24803
The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks
Base scoreN/A/ 10
SeverityNoneCVSS unscored
Exploitability / impact
CVSS metric breakdown
Base severityNone
No CVSS vector is available for this record.
CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedAug 3, 2024 19:42:17 UTC
PublishedFeb 28, 2022 09:06:09 UTC
ReservedJan 14, 2021 00:00:00 UTC
Credits
- Francesco Carlucci