CVE-2021-24380

State: PUBLISHED · Published: 2021-08-16 · Updated: 2024-08-03 · Assigner: WPScan

Description

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

CWE

CWE-352 — CWE-352 Cross-Site Request Forgery (CSRF)

Affected

Unknown / Shantz WordPress QOTD — v=1.2.2 ≤1.2.2 [affected]

CVSS

(none)

References

https://wpscan.com/vulnerability/1dd0f9a8-22ab-4ecc-a925-605822739000 x_refsource_MISC

Source

cvelistV5-main/cves/2021/24xxx/CVE-2021-24380.json