CVE-2021-24853 QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update

2021-11-1710:15:57

CWE-284

WPScan

www.cve.org

cve-2021-24853

qr redirector

wordpress

csrf checks

authenticated user

redirect response status

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

36.7%

JSON

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects

CNA Affected

[
  {
    "product": "QR Redirector",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.6",
        "status": "affected",
        "version": "1.6",
        "versionType": "custom"
      }
    ]
  }
]