CVE-2021-24215 Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation
Unauthenticated attackers can access admin customization and settings pages, leading to privilege escalation and potential site compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24215?
CVE-2021-24215 is a critical missing authorization vulnerability in Unknown Controlled Admin Access, published on 12 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.
Which versions are affected by CVE-2021-24215?
It affects 1 product.
Products include Wpruby Controlled Admin Access.
How do I fix CVE-2021-24215?
No fix has been published for CVE-2021-24215 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24215 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24215 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Unknown Controlled Admin Access
Sources
Also known as GHSA-5wrq-c7c8-h4hx.