CVE-2021-4448

HIGH EXPLOITED NUCLEI

Kaswara < 3.0.1 - Missing Authorization

Title source: rule

Description

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.

Nuclei Templates (1)

Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization

HIGHVERIFIEDby daffainfo

Shodan: html:"kaswara"

References (2)

[Not Applicable] https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477

[Third Party Advisory] https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf76527-9a11-4755-992c-02fbc1a79bae?source=cve

Scores

CVSS v3 7.3

EPSS 0.4890

EPSS Percentile 97.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

VulnCheck KEV 2024-10-15

CWE

CWE-862

Status published

Products (2)

kaswara_project/kaswara < 3.0.1

SayenThemes/Kaswara Modern VC Addons < 3.0.1

Published Oct 16, 2024

Tracked Since Feb 18, 2026