Lucene search
PRIOn knowledge basePRION:CVE-2021-24839HistoryFeb 07, 2022 - 4:15 p.m.
Cross site request forgery (csrf)
2022-02-0716:15:00
PRIOn knowledge base
www.prio-n.com
6
0.001 Low
EPSS
Percentile
41.6%
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
| CPE | Name | Operator | Version |
|---|---|---|---|
| supportcandy | lt | 2.2.5 |
Related
nvd
nvd
CVE-2021-24839
2022-02-07 16:15:41
cve
cve
CVE-2021-24839
2022-02-07 16:15:41
patchstack
patchstack
cvelist
cvelist
wpvulndb
wpvulndb
SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion
2022-01-05 00:00:00
wpexploit
wpexploit
SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion
2022-01-05 00:00:00