blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24892

HIGH 8.8 CVSS 3.1
Published
November 23, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-639
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.

Affected products and versions

  • TODO Advanced Forms Ppro — From 1.6.9 (including) to 1.6.9 (excluding)
  • TODO Advanced Forms — From 1.6.9 (including) to 1.6.9 (excluding)
  • advanced_forms_project advanced_forms — Before 1.6.9

References

  • github.com https://github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2 Patch, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/364b0843-a990-4204-848a-60c928cc5bc0 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record