CVE-2021-24703CWE-732

Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation

published November 23, 2021

CVSS
—
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwap_plugin_activate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00398 · 32.9th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2021-11-23T19:16Z
EPSS history
Timeline
  • 23 NOV 19:16Z
    Download Plugin < 1.6.1 - Subscriber+ Arbitrary Plugin Activation
    cvelistv5