CVE-2021-24767

The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.55% chance of exploitation in the next 30 days, 44th percentile

Published

2021-11-08

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/0b35ad4a-3d94-49b1-a98d-07acf8dd4962

References

• CVE Record
• NVD entry

Related

• CVE-2021-24766
• CVE-2021-24768
• CVE-2021-24765
• CVE-2021-24769
• CVE-2021-24764
• CVE-2021-24770