CVE-2021-24827
CRITICAL EXPLOITED NUCLEIAsgaros Forum WP <1.15.13 - SQL Injection
Title source: llmExploitation Summary
CVE-2021-24827 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.
Description
The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection issue
Nuclei Templates (1)
WordPress Asgaros Forum <1.15.13 - SQL Injection
CRITICALVERIFIEDby theamanrawat
References (2)
Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/36cc5151-1d5e-4874-bcec-3b6326235db1
Patch, Third Party Advisory x_refsource_confirm
https://plugins.trac.wordpress.org/changeset/2611560/asgaros-forum
Scores
CVSS v3
9.8
EPSS
0.1294
EPSS Percentile
95.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2025-06-07
CWE
CWE-89
Status
published
Products (1)
asgaros/asgaros_forum
< 1.15.13
Published
Nov 08, 2021
Tracked Since
Feb 18, 2026