CVE-2021-24318

🗓️ 01 Jun 2021 11:33:30Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 55 Views🌐 WEB

The Listeo WordPress theme before 1.6.11 allows authenticated users to delete arbitrary page/post and booking

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2021-24318	1 Jun 202114:15	–	attackerkb
CNNVD	WordPress 插件访问控制错误漏洞	1 Jun 202100:00	–	cnnvd
CNVD	Unspecified vulnerability in Listeo WordPress plugin (CNVD-2021-44295)	6 Jun 202100:00	–	cnvd
Cvelist	CVE-2021-24318 Listeo < 1.6.11 - Multiple Authenticated IDOR Vulnerabilities	1 Jun 202111:33	–	cvelist
EUVD	EUVD-2021-11232	7 Oct 202500:30	–	euvd
NVD	CVE-2021-24318	1 Jun 202114:15	–	nvd
OSV	CVE-2021-24318	1 Jun 202114:15	–	osv
Prion	Cross site request forgery (csrf)	1 Jun 202114:15	–	prion
Positive Technologies	PT-2021-15855 · WordPress · Listeo	1 Jun 202100:00	–	ptsecurity
RedhatCVE	CVE-2021-24318	22 May 202518:23	–	redhatcve

NVD

Vulners

Node

purethemes listeoRange<1.6.11wordpress

[
  {
    "product": "Listeo",
    "vendor": "purethemes",
    "versions": [
      {
        "lessThan": "1.6.11",
        "status": "affected",
        "version": "1.6.11",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
m0ze	www.m0ze.ru/vulnerability/%5B2021-02-10%5D-%5BWordPress%5D-%5BCWE-639%5D-Listeo-WordPress-Theme-v1.6.10.txt
wpscan	www.wpscan.com/vulnerability/9afa7e11-68b3-4196-975e-8b3f8e68ce56

Parameter	Position	Path	Description	CWE
listing_id	query param	/my-listings/?status=pending&action=delete&listing_id=13&_wpnonce=88a432b100	IDOR vulnerability allowing authenticated users to delete arbitrary posts/pages via listing_id in the query string.	CWE-639, CWE-284
_wpnonce	query param	/my-listings/?status=pending&action=delete&listing_id=13&_wpnonce=88a432b100	IDOR vulnerability allowing authenticated users to delete arbitrary posts/pages via listing_id in the query string.	CWE-639, CWE-284
status	query param	/my-listings/?status=pending&action=delete&listing_id=13&_wpnonce=88a432b100	IDOR vulnerability allowing authenticated users to delete arbitrary posts/pages via listing_id in the query string.	CWE-639, CWE-284
action	query param	/my-listings/?status=pending&action=delete&listing_id=13&_wpnonce=88a432b100	IDOR vulnerability allowing authenticated users to delete arbitrary posts/pages via listing_id in the query string.	CWE-639, CWE-284
booking_id	request body	/wp-admin/admin-ajax.php	IDOR vulnerability allowing authenticated users to delete arbitrary bookings via booking_id in POST data to admin-ajax.php.	CWE-639, CWE-284
status	request body	/wp-admin/admin-ajax.php	IDOR vulnerability allowing authenticated users to delete arbitrary bookings via booking_id in POST data to admin-ajax.php.	CWE-639, CWE-284
action	request body	/wp-admin/admin-ajax.php	IDOR vulnerability allowing authenticated users to delete arbitrary bookings via booking_id in POST data to admin-ajax.php.	CWE-639, CWE-284

17 Jun 2026 03:39Current

6.4Medium risk

Vulners AI Score6.4

CVSS 25.5

CVSS 3.16.5

EPSS0.00986