CVE-2021-25032
CVSS v3
9.8
CRITICAL
EPSS Score
81.9 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.
Technical details
- Published
- 2022-01-10
Frequently asked questions
What is CVE-2021-25032?
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.
Is CVE-2021-25032 actively exploited?
Active exploitation of CVE-2021-25032 has not been confirmed. The EPSS score is 81.9%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2021-25032?
CVE-2021-25032 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2021-25032 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2021 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).