Lucene search
WPScanCVELIST:CVE-2021-24226HistoryApr 12, 2021 - 2:04 p.m.
CVE-2021-24226 AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage
2021-04-1214:04:46
CWE-200
WPScan
www.cve.org
0.026 Low
EPSS
Percentile
90.4%
In the AccessAlly WordPress plugin before 3.5.7, the file “resource/frontend/product/product-shortcode.php” responsible for the [accessally_order_form] shortcode is dumping serialize($_SERVER), which contains all environment variables. The leakage occurs on all public facing pages containing the [accessally_order_form] shortcode, no login or administrator role is required.
CNA Affected
[
{
"product": "AccessAlly",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.5.6*",
"status": "affected",
"version": "3.5.6",
"versionType": "custom"
},
{
"lessThan": "3.5.7",
"status": "affected",
"version": "3.5.7",
"versionType": "custom"
}
]
}
]Related
nuclei
nuclei
AccessAlly <3.5.7 - Sensitive Information Leakage
2021-09-28 16:56:37
prion
prion
Design/Logic Flaw
2021-04-12 14:15:00
wpexploit
wpexploit
AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage
2021-03-26 00:00:00
nvd
nvd
CVE-2021-24226
2021-04-12 14:15:15
patchstack
patchstack
wpvulndb
wpvulndb
AccessAlly < 3.5.7 - $_SERVER Superglobal Leakage
2021-03-26 00:00:00
cve
cve
CVE-2021-24226
2021-04-12 14:15:15