High severity · published May 14, 2021
CVE-2021-24188
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install…
8.8
CVSS
1.3%
EPSS
No
On KEV
Description
Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WC
WP Content Copy Protection & NO Right Click · Wp-buy
before 3.1.5 · source: NVD
Affected product
WC
WP Content Copy Protection & NO Right Click
Wp-buy
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24188
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24188
Exploit
https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c
More from WP Content Copy Protection & NO Right Click
8.8
CVE-2024-49306
WordPress WP Content Copy Protection & No Right Click plugin <= 3.5.9 - Cross Site Request Forgery (CSRF) vulnerability
8.8
CVE-2022-23983
WordPress WP Content Copy Protection & No Right Click plugin <= 3.4.4 - Cross-Site Request Forgery (CSRF) leads to Settings Update vulnerability
6.1
CVE-2024-6690
WP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirect
4.8
CVE-2024-6693
WP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS
4.8
CVE-2023-36678
WordPress WP Content Copy Protection & No Right Click Plugin <= 3.5.5 is vulnerable to Cross Site Scripting (XSS)