CVE-2021-24380CWE-352

Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF

published August 16, 2021

CVSS
—
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-08-16T10:48Z
EPSS history
Timeline
  • 16 AUG 10:48Z
    Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF
    cvelistv5