CVE-2021-4448

HIGHNuclei

Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2021-4448 has a selected CVSS score of 7.3 (high); EIP currently links 1 Nuclei template.

Description

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Oct 15, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 16, 2024 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Kaswara Modern VC Addons plugin for WordPress

Browse Kaswara / Kaswara Modern VC Addons plugin for WordPress
VulnCheckVersion data not supplied

Kaswara Modern VC Addons

Browse SayenThemes / Kaswara Modern VC Addons

Default status: unaffected

CVE ListThrough 3.0.1affected

kaswara

Browse kaswara_project / kaswara

Default status: unknown

CVE ListThrough 3.0.1affected

Nuclei templates

1
ProjectDiscoveryHIGHKaswara Modern VC Addons <= 3.0.1 - Missing AuthorizationCVSS 7.3

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.

Impact

Unauthenticated attackers can perform unauthorized actions including file uploads, deletions, and data import, potentially leading to site compromise.

Remediation

Deactivate and delete the plugin from the server

WeaknessesCWE-862
Authorsdaffainfo
Template tagscvecve2021wpwordpresswp-pluginkaswaraoastvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CPE: cpe:2.3:a:kaswara_project:kaswara:*:*:*:*:*:wordpress:*:*
Shodan: html:"kaswara"
https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477 https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kaswara/kaswara-modern-vc-addons-301-missing-authorization

Source: ProjectDiscovery

References

3