CVE-2021-24215

CRITICAL NUCLEI

Controlled Admin Access < 1.5.2 - Unauthenticated Improper Access Control

Title source: llm

Exploitation Summary

CVE-2021-24215 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.

Nuclei Templates (1)

Controlled Admin Access WordPress Plugin <= 1.4.0 - Improper Access Control & Privilege Escalation

CRITICALVERIFIEDby r3Y3r53

Shodan: http.html:/wp-content/plugins/controlled-admin-access/

FOFA: body=/wp-content/plugins/controlled-admin-access/

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_confirm

https://wpscan.com/vulnerability/eec0f29f-a985-4285-8eed-d1855d204a20

Various Sources x_refsource_misc

https://m0ze.ru/vulnerability/%5B2021-03-18%5D-%5BWordPress%5D-%5BCWE-284%5D-Controlled-Admin-Access-WordPress-Plugin-v1.4.0.txt

Scores

CVSS v3 9.8

EPSS 0.0973

EPSS Percentile 94.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-284 CWE-425

Status published

Products (1)

wpruby/controlled_admin_access < 1.5.2

Published Apr 12, 2021

Tracked Since Feb 18, 2026