CVE-2021-24230: Patreon WordPress < 1.7.0 - CSRF to Overwrite/Create User Meta
The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wpcapabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24230?
The severity of CVE-2021-24230 is high with a severity value of 8.1.
How does CVE-2021-24230 impact the Patreon WordPress plugin?
CVE-2021-24230 allows attackers to make a logged in user overwrite or create arbitrary user metadata on the victim's account.
Which version of the Patreon WordPress plugin is affected by CVE-2021-24230?
The Patreon WordPress plugin before version 1.7.0 is affected by CVE-2021-24230.
How can an attacker exploit CVE-2021-24230?
An attacker can exploit CVE-2021-24230 by visiting the victim's account and using a Cross-Site Request Forgery attack to overwrite or create arbitrary user metadata.
Is there a fix available for CVE-2021-24230?
Yes, the fix for CVE-2021-24230 is to update the Patreon WordPress plugin to version 1.7.0 or later.