There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62 | Third Party Advisory |
| https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/ | Third Party Advisory |
| https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62 | Third Party Advisory |
| https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62 - Third Party Advisory | |
| References | () https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/ - Third Party Advisory |
24 May 2021, 18:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62 - Third Party Advisory | |
| References | (MISC) https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/ - Third Party Advisory | |
| CPE | cpe:2.3:a:de-baat:store_locator_plus:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
| CWE | CWE-269 |
Information
Published : 2021-05-17 17:15
Updated : 2024-11-21 05:52
NVD link : CVE-2021-24289
Mitre link : CVE-2021-24289
CVE.ORG link : CVE-2021-24289
JSON object : View
Products Affected
de-baat
- store_locator_plus
CWE
CWE-269
Improper Privilege Management