CVE-2021-24251CWE-352

Business Directory Plugin < 5.11.2 - Arbitrary Payment History Update

published May 5, 2021

CVSS
—
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status (from pending to completed to example)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00474 · 40.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-05-05T18:39Z
EPSS history
Timeline
  • 05 MAY 18:39Z
    Business Directory Plugin < 5.11.2 - Arbitrary Payment History Update
    cvelistv5