CVE-2021-24230: fallo en Patreon WordPress
Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User Meta
Publicada el · Actualizada el
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 0.6%
probabilidad de explotación
0.6%top 52% de las CVE
explotación observada
noninguna fuente lo reporta
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content.
Productos afectados
Unknown · Patreon WordPressCVEs relacionadas — Patreon WordPress
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-24227—Patreon WordPress < 1.7.0 - Unauthenticated Local File DisclosureEPSS 5.9%CVE-2021-24228—Patreon WordPress < 1.7.2 - Reflected XSS on Login FormEPSS 1.9%CVE-2021-24229—Patreon WordPress < 1.7.2 - Reflected XSS on patreon_save_attachment_patreon_level AJAX actionEPSS 1.8%CVE-2021-25026—Patreon WordPress < 1.8.2 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%CVE-2021-24231—Patreon WordPress < 1.7.0 - CSRF to Disconnect Sites From PatreonEPSS 0.6%CVE-2026-92431LOWPatreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term EnumerationEPSS 0.2%