The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
References
Link | Resource |
---|---|
https://wpscan.com/vulnerability/15eed13f-3195-4f5d-8933-36695c830f4f | Exploit Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: WPScan
Published: 2021-12-13T10:41:04
Updated: 2021-12-13T10:41:04
Reserved: 2021-01-14T00:00:00
Link: CVE-2021-24836
JSON object: View
NVD Information
Status : Analyzed
Published: 2021-12-13T11:15:08.910
Modified: 2022-08-04T18:53:46.213
Link: CVE-2021-24836
JSON object: View
Redhat Information
No data.