CVE-2021-24207

WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts

Severity Score

4.3

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages.

Por defecto, el plugin de WordPress WP Page Builder versiones anteriores a 1.2.4, permite a usuarios de nivel de suscriptor editar y realizar cambios en todas y cada una de las páginas de publicaciones; los roles de usuario deben ser bloqueados específicamente para que no puedan editar publicaciones y páginas

*Credits: Ramuel Gall

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-01-14 CVE Reserved
2021-04-05 CVE Published
2023-03-08 EPSS Updated
2024-08-03 CVE Updated
2024-08-03 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-269: Improper Privilege Management
CWE-863: Incorrect Authorization
CWE-1188: Initialization of a Resource with an Insecure Default

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC
https://wpscan.com/vulnerability/21e7a46f-e9a3-4b20-b44a-a5b6ce7b7ce6	2024-08-03

URL	Date	SRC

URL	Date	SRC
https://www.themeum.com/wp-page-builder-updated-v1-2-4	2022-07-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Themeum Search vendor "Themeum"		Wp Page Builder Search vendor "Themeum" for product "Wp Page Builder"				< 1.2.4 Search vendor "Themeum" for product "Wp Page Builder" and version " < 1.2.4"		wordpress		Affected