CVE-2021-24827

CRITICALNuclei

Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-24827 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jun 7, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Asgaros Forum

CVE List1.15.13 to < 1.15.13affected

asgaros_forum

Browse asgaros / asgaros_forum
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Asgaros Forum <1.15.13 - SQL InjectionCVSS 9.8

WordPress Asgaros Forum plugin before 1.15.13 is susceptible to SQL injection. The plugin does not validate and escape user input when subscribing to a topic before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation.

Remediation

Upgrade to the latest version of Asgaros Forum (1.15.13 or higher) to mitigate this vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicve2021cvewp-pluginasgaros-forumunauthwpscanwordpresswpsqliasgarosvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:asgaros:asgaros_forum:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1 https://wordpress.org/plugins/asgaros-forum/ https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum https://nvd.nist.gov/vuln/detail/CVE-2021-24827 https://github.com/20142995/sectool

Source: ProjectDiscovery

References

3