CVE-2021-24244

An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

0.94% chance of exploitation in the next 30 days, 58th percentile

Published

2021-05-05

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/354b98d8-46a1-4189-b347-198701ea59b9

References

• CVE Record
• NVD entry

Related

• CVE-2021-24243
• CVE-2021-24245
• CVE-2021-24242
• CVE-2021-24246
• CVE-2021-24241
• CVE-2021-24247