CVE-2021-24633 Countdown Block < 1.1.2 - Missing Authorisation in AJAX action

2021-09-2715:25:26

CWE-862

WPScan

www.cve.org

wordpress

plugin

authorisation

ajax

action

user

subscriber

post contents

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.

CNA Affected

[
  {
    "product": "Countdown Block",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.1.2",
        "status": "affected",
        "version": "1.1.2",
        "versionType": "custom"
      }
    ]
  }
]