CVE-2021-24289CWE-269

Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.1%

probabilidade de exploração

1.1%top 35% das CVEs

exploração observada

nãonenhuma fonte reporta

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.

Produtos afetados

Store Locator Plus · Store Locator Plus for WordPress

Referências

https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62 https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/