CVE-2021-24968: Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation
Published Jan 24, 2022
·Updated
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewdufaqwelcomeaddfaq and ewdufaqwelcomeaddfaqpage AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
Affected Software
1 affected component
Etoilewebdesign Ultimate Faq Wordpress<2.1.2
Remediation
Patch Available
Event History
Jan 24, 2022
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2021-24968.
2
What is the severity level of CVE-2021-24968?
The severity level of CVE-2021-24968 is medium.
3
Which software versions are affected by CVE-2021-24968?
The Ultimate FAQ WordPress plugin versions up to and exclusive of 2.1.2 are affected by CVE-2021-24968.
4
What is the risk of CVE-2021-24968?
CVE-2021-24968 allows authenticated users with low-level roles, such as Subscriber, to create FAQ and FAQ questions.
5
How can CVE-2021-24968 be mitigated?
To mitigate CVE-2021-24968, users should update to version 2.1.2 or newer of the Ultimate FAQ WordPress plugin.