blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24688

MEDIUM 4.3 CVSS 3.1
Published
February 28, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-284, CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Description

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown Orange Form — From 1.0.1 (including) to 1.0.1 (including)
  • orange-form_project orange-form — Up to and including 1.0.1

References

  • wpscan.com https://wpscan.com/vulnerability/78bc7cf1-7563-4ada-aec9-af4c943e3e2c Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record