CVE-2021-24238

PoC —

CVSS 3.1

6.5 medium

EPSS

1%p64

Published

Apr 22, 2021 (Apr 22, 2021)

Modified

Jun 17, 2026

Description

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.

Vendors: purethemes
Products: findeo, realteo
Ecosystems: WordPress
Weakness: CWE-284, CWE-425
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.