CVE-2021-4448
HIGH EXPLOITED NUCLEIKaswara Modern VC Addons <= 3.0.1 - Unauthenticated Authorization Bypass via AJAX Actions
Title source: llmExploitation Summary
CVE-2021-4448 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.
Description
The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.
Nuclei Templates (1)
Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization
HIGHVERIFIEDby daffainfo
Shodan:
html:"kaswara"
References (2)
Core 2
Core References
Scores
CVSS v3
7.3
EPSS
0.0134
EPSS Percentile
67.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
VulnCheck KEV
2024-10-15
CWE
CWE-862
Status
published
Products (2)
kaswara_project/kaswara
< 3.0.1
SayenThemes/Kaswara Modern VC Addons
< 3.0.1
Published
Oct 16, 2024
Tracked Since
Feb 18, 2026