CVE-2021-24380 Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF

2021-08-1610:48:18

CWE-352

WPScan

www.cve.org

cve-2021-24380

shantz wordpress qotd

csrf

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

27.4%

JSON

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

CNA Affected

[
  {
    "product": "Shantz WordPress QOTD",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThanOrEqual": "1.2.2",
        "status": "affected",
        "version": "1.2.2",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/1dd0f9a8-22ab-4ecc-a925-605822739000