CVE-2021-24354

A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

1.48% chance of exploitation in the next 30 days, 72th percentile

Published

2021-06-14

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/8638b36c-6641-491f-b9df-5db3645e4668

References

• CVE Record
• NVD entry

Related

• CVE-2021-24353
• CVE-2021-24355
• CVE-2021-24352
• CVE-2021-24356
• CVE-2021-24351
• CVE-2021-24357