« Volver al listado

CVE-2021-24803

Estado: ModificadaAlta (8.8)—

The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Core Tweaks WP Setup Project — Core Tweaks WP Setup

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-24803",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "Core Tweaks WP Setup",
          "versions": [
            {
              "status": "affected",
              "version": "4.1",
              "versionType": "custom",
              "lessThanOrEqual": "4.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-28T09:15:07.620",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "contact@wpscan.com"
    },
    {
      "url": "https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "contact@wpscan.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks"
    },
    {
      "lang": "es",
      "value": "El plugin Core Tweaks WP Setup de WordPress versiones hasta 4.1, permite la configuración masiva de muchos ajustes en WordPress, incluyendo el correo electrónico del administrador, así como la creación de una nueva cuenta de administrador. No se presenta protección de tipo CSRF, permitiendo a un atacante cambiar arbitrariamente el correo electrónico del administrador o crear otra cuenta de administrador y tomar el control del sitio web por medio de ataques de tipo CSRF."
    }
  ],
  "lastModified": "2026-06-17T03:40:56.140",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:core_tweaks_wp_setup_project:core_tweaks_wp_setup:*:*:*:*:*:wordpress:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0B8E693F-2306-4448-A14E-65A6B2E9409B",
              "versionEndIncluding": "4.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "contact@wpscan.com"
}