blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24238

MEDIUM 6.5 CVSS 3.1
Published
April 22, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-284, CWE-425
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.

Affected products and versions

  • PureThemes Realteo — From 1.2.4 (including) to 1.2.4 (excluding)
  • PureThemes Findeo — From 1.3.1 (including) to 1.3.1 (excluding)
  • purethemes findeo — Before 1.3.1
  • purethemes realteo — Before 1.2.4

References

  • m0ze.ru https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Findeo-WordPress-Theme-v1.3.0.txt
  • m0ze.ru https://m0ze.ru/vulnerability/%5B2021-03-20%5D-%5BWordPress%5D-%5BCWE-284%5D-Realteo-WordPress-Plugin-v1.2.3.txt
  • wpscan.com https://wpscan.com/vulnerability/b8434eb2-f522-484f-9227-5f581e7f48a5 Exploit, Third Party Advisory
  • www.docs.purethemes.net https://www.docs.purethemes.net/findeo/knowledge-base/changelog-findeo/ Release Notes, Vendor Advisory
  • nvd.nist.gov Official NVD record