CVE-2021-24238CWE-284

Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR

published April 22, 2021

CVSS
—
EPSS
1%
Percentile
65.8
In the wild
Unconfirmed
What it is

The Realteo WordPress plugin before 1.2.4, used by the Findeo Theme, did not ensure that the requested property to be deleted belong to the user making the request, allowing any authenticated users to delete arbitrary properties by tampering with the property_id parameter.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01114 · 65.8th percentile
Weakness
CWE-284 · Improper Access Control
Published
2021-04-22T21:00Z
EPSS history
Timeline
  • 22 APR 21:00Z
    Realteo < 1.2.4 - Arbitrary Property Deletion via IDOR
    cvelistv5