CVE-2021-24978

The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wpajaxnopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in place to ensure that the post to delete ...

CVE-2021-24978

creationtimestamp| type| source ---|---|--- 2022-03-28 22:42:06+00:00| seen| https://t.me/cibsecurity/39674...

CVE-2021-24978

CVE-2021-24978 concerns the OSMapper WordPress plugin (versions ≤ 2.1.5). The vulnerability arises from an AJAX action used to delete a plugin-related post type named “map” that is registered with the wp_ajax_nopriv prefix, making it accessible to unauthenticated users. There is no authorization,...