Critical severity · published Jan 10, 2022
CVE-2021-25032
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating…
9.8
CVSS
6.7%
EPSS
No
On KEV
Description
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)6.7% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Capabilities · Publishpress
before 2.3.1; before 2.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25032
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25032
Patch
https://plugins.trac.wordpress.org/changeset/2640161
Exploit
https://wpscan.com/vulnerability/2f0f1a32-0c7a-48e6-8617-e0b2dcf62727
More from Capabilities
7.2
CVE-2022-3366
PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection