CVE-2021-24767: Redirect 404 Error Page to Homepage or Custom Page with Logs < 1.7.9 - Log Deletion via CSRF
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24767?
CVE-2021-24767 is considered a medium severity vulnerability due to the potential for CSRF attacks affecting logged-in administrators.
How do I fix CVE-2021-24767?
To fix CVE-2021-24767, update the Fullworks Redirect 404 Error Page To Homepage Or Custom Page With Logs plugin to version 1.7.9 or later.
What type of attack does CVE-2021-24767 allow?
CVE-2021-24767 allows attackers to perform a Cross-Site Request Forgery (CSRF) attack to delete logs as an authenticated admin.
Who is affected by CVE-2021-24767?
Users of the Fullworks Redirect 404 Error Page To Homepage Or Custom Page With Logs plugin prior to version 1.7.9 are affected by CVE-2021-24767.
What can an attacker do with CVE-2021-24767?
An attacker can exploit CVE-2021-24767 to force an authenticated administrator to unintentionally delete logs.