blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24803

HIGH 8.8 CVSS 3.1
Published
February 28, 2022
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-352
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks

Affected products and versions

  • Unknown Core Tweaks WP Setup — From 4.1 (including) to 4.1 (including)
  • core_tweaks_wp_setup_project core_tweaks_wp_setup — Up to and including 4.1

References

  • wpscan.com https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record