CVE-2021-24767 Redirect 404 Error Page to Homepage or Custom Page with Logs < 1.7.9 - Log Deletion via CSRF
A CSRF vulnerability in a WordPress plugin allows attackers to force logged-in admins to delete logs, compromising audit trails.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24767?
CVE-2021-24767 is a medium-severity vulnerability in Unknown Redirect 404 Error Page to Homepage or Custom Page with Logs, published on 8 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
Weakness: CWE-352
Which versions are affected by CVE-2021-24767?
It affects 1 product.
Products include Wpvibes Redirect 404 Error Page to Homepage or Custom Page With Logs.
How do I fix CVE-2021-24767?
No fix has been published for CVE-2021-24767 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24767 being exploited?
There is no known exploitation of CVE-2021-24767 in the wild and no public exploit code.
Other vulnerabilities in Unknown Redirect 404 Error Page to Homepage or Custom Page with Logs
Sources
Also known as GHSA-q43p-2mh4-5jv2.