by Kastro
Paper/Archive/CVE-2021-4360

CVE-2021-4360

waseem_senjer Controlled Admin Access — Controlled Admin Access < 1.5.6 - Privilege Escalation

EPSS 1%CVSS 9.9
critical.is priorityof 100
43
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 67.0.670 × 2013.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.

Affected

ProductAffectedFixed inSource
Controlled Admin Access< 1.5.61.5.6CNA

Scores by source

Wordfence (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=cverefblog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-pluginrefplugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txtrefwpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379c