CVE-2021-24968
PoC —CVSS 3.1
5.7 medium
EPSS
<1%p36
Published
()
Modified
Description
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
- Vendors
- etoilewebdesign
- Products
- ultimate faq
- Ecosystems
- WordPress
- Weakness
- CWE-862, CWE-352
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
In the news0 stories
No ingested article mentions this CVE yet.