CVE Vulnerabilities

CVE-2021-24191

Published: May 14, 2021 | Modified: Jul 30, 2022
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Low privileged users can use the AJAX action cp_plugins_do_button_job_later_callback in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.

Affected Software

Name Vendor Start Version End Version
Coming_soon_page_&_maintenance_mode Wpshopmart * *

References