CVE-2021-24803

HIGH

Core Tweaks WP Setup < 4.1 - Cross-Site Request Forgery

Title source: llm
STIX 2.1

Description

The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42

Scores

CVSS v3 8.8
EPSS 0.0062
EPSS Percentile 45.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (1)
core_tweaks_wp_setup_project/core_tweaks_wp_setup < 4.1
Published Feb 28, 2022
Tracked Since Feb 18, 2026