CVE-2021-24916

HIGH NUCLEI

Qubely < 1.8.6 - Unauthenticated Arbitrary Email Sending via qubely_send_form_data AJAX Action

Title source: llm

Exploitation Summary

CVE-2021-24916 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

The Qubely WordPress plugin before 1.8.6 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses via the qubely_send_form_data AJAX action.

Nuclei Templates (1)

WordPress Qubely < 1.8.6 - Unauthenticated Email Sending

HIGHVERIFIEDby roberto

FOFA: body="qubely_urls"

References (1)

Core 1

Core References

Exploit, Third Party Advisory exploit vdb-entry technical-description

https://wpscan.com/vulnerability/93b893be-59ad-4500-8edb-9fa7a45304d5

Scores

CVSS v3 7.5

EPSS 0.0154

EPSS Percentile 71.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

Status published

Products (1)

themeum/qubely < 1.8.6

Published Aug 07, 2023

Tracked Since Feb 18, 2026