CVE-2021-24916 Qubely < 1.8.6 - Unauthenticated Arbitrary E-mail Sending
Unauthenticated attackers can send arbitrary emails via the Qubely WordPress plugin, enabling spam or phishing campaigns.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24916?
CVE-2021-24916 is a high-severity vulnerability in Unknown Qubely, published on 7 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.
Which versions are affected by CVE-2021-24916?
It affects 1 product.
Products include Themeum Qubely.
How do I fix CVE-2021-24916?
No fix has been published for CVE-2021-24916 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24916 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-24916 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Unknown Qubely
- CVE-2025-26767 WordPress Qubely plugin <= 1.8.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-9601 Cross-site scripting in Qubely – Advanced Gutenberg Blocks
- CVE-2021-25013 Qubely < 1.7.8 - Subscriber+ Arbitrary Post Deletion
- CVE-2023-0376 Qubely < 1.8.5 - Contributor+ Stored XSS
- CVE-2024-13228 Information disclosure in Qubely – Advanced Gutenberg Blocks
Sources
Also known as GHSA-w9rc-g9q5-4rpr.