CVE-2021-24989: Accept Donations with PayPal < 1.3.4 - Arbitrary Post Deletion via CSRF
Published Jan 24, 2022
·Updated
The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and does not ensure that the post to be deleted belongs to the plugin, allowing attackers to make a logged in admin delete arbitrary posts from the blog
Affected Software
1 affected component
Wpplugin Accept Donations With Paypal Wordpress<1.3.4
Event History
Jan 24, 2022
CVE Published
via MITRE·08:01 AM
Data Sourced
via MITRE·08:01 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID is CVE-2021-24989.
2
What is the title of this vulnerability?
The title of this vulnerability is 'The Accept Donations with PayPal WordPress plugin before 1.3.4 does not have CSRF check in place and…'
3
What is the severity of CVE-2021-24989?
The severity of CVE-2021-24989 is medium (6.5).
4
How does CVE-2021-24989 impact the Accept Donations with PayPal WordPress plugin?
CVE-2021-24989 allows attackers to make a logged-in admin delete arbitrary posts from the blog.
5
How can I fix the vulnerability in the Accept Donations with PayPal WordPress plugin?
To fix the vulnerability, update the plugin to version 1.3.4 or newer.