CVE-2021-24289

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

1.15%

Published

May 17, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-269

Affected Products (1)

de-baat · store_locator_plusvulnerable

References (4)

https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62

Third Party Advisory

https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/

Third Party Advisory

https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62

Third Party Advisory

https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs