CVE-2021-24380

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.45% chance of exploitation in the next 30 days, 38th percentile

Published

2021-08-16

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1dd0f9a8-22ab-4ecc-a925-605822739000

References

• CVE Record
• NVD entry

Related

• CVE-2021-24379
• CVE-2021-24381
• CVE-2021-24378
• CVE-2021-24382
• CVE-2021-24377
• CVE-2021-24383