CVE-2021-24188CWE-285

WP Content Copy Protection & No Right Click < 3.1.5 - Arbitrary Plugin Installation/Activation via Low Privilege User

published May 14, 2021

CVSS
—
EPSS
1%
Percentile
70.7
In the wild
Unconfirmed
What it is

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01325 · 70.7th percentile
Weakness
CWE-285 · Improper Authorization
Published
2021-05-14T11:38Z
EPSS history
Timeline
  • 14 MAY 11:38Z
    WP Content Copy Protection & No Right Click < 3.1.5 - Arbitrary Plugin Installation/Activation via Low Privilege User
    cvelistv5