CVE-2021-24688CWE-284

Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion

published February 28, 2022

CVSS
—
EPSS
0%
Percentile
36.5
In the wild
Unconfirmed
What it is

The Orange Form WordPress plugin through 1.0.1 does not have any authorisation and CSRF checks in all of its AJAX calls, for example the or_delete_filed one which is available to both unauthenticated and authenticated users could allow attackers to delete arbitrary posts.The AJAX calls performing actions on posts also do not ensure that the post belong to them (or that they are allowed to perform such action on it)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2022-02-28T09:06Z
EPSS history
Timeline
  • 28 FEB 09:06Z
    Orange Form <= 1.0.1 - Unauthenticated Arbitrary Post Deletion
    cvelistv5