CVE-2021-24906 Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation

2022-01-2408:00:53

CWE-862

WPScan

www.cve.org

0.001 Low

EPSS

Percentile

44.6%

JSON

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request

CNA Affected

[
  {
    "product": "Protect WP Admin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "3.6.2",
        "status": "affected",
        "version": "3.6.2",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/4204682b-f657-42e1-941c-bee7a245e9fd

0.001 Low

EPSS

Percentile

44.6%

JSON

Related for CVELIST:CVE-2021-24906