CVE-2021-24806

The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment.

CVSS v3.1

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.48% chance of exploitation in the next 30 days, 40th percentile

Published

2021-11-08

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/2746101e-e993-42b9-bd6f-dfd5544fa3fe

References

• CVE Record
• NVD entry

Related

• CVE-2021-24805
• CVE-2021-24807
• CVE-2021-24804
• CVE-2021-24808
• CVE-2021-24803
• CVE-2021-24809