CVE-2021-24928

 

Published at: - 07-02-2022 05:15

Last modified: - 24-10-2022 06:40

Total changes: - 3

Description

The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action, nor validation and escaping when inserting user data in SQL statement, leading to an SQL injection, and allowing any authenticated user, such as subscriber, to modify arbitrary post content (for example with an XSS payload), as well as exfiltrate any data by copying it to another post.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

 

Verification logic

 

Reference

• https://wpscan.com/vulnerability/3762a77c-b8c9-428f-877c-bbfd7958e7be

 

Keywords

NVD

 

CVE-2021-24928

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures