CVE-2021-24803 Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF
Attackers can exploit missing CSRF protection to create admin accounts or change admin emails, leading to full website takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24803?
CVE-2021-24803 is a high-severity vulnerability in Unknown Core Tweaks WP Setup, published on 28 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks
Weakness: CWE-352
Which versions are affected by CVE-2021-24803?
It affects 1 product.
Products include Core Tweaks Wp Setup Project Core Tweaks Wp Setup.
How do I fix CVE-2021-24803?
No fix has been published for CVE-2021-24803 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24803 being exploited?
There is no known exploitation of CVE-2021-24803 in the wild and no public exploit code.
Sources
Also known as GHSA-cjg4-c2hx-54x2.