CVE-2021-24804CWE-352

Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF

published November 17, 2021

CVSS
—
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

The Simple JWT Login WordPress plugin before 3.2.1 does not have nonce checks when saving its settings, allowing attackers to make a logged in admin changed them. Settings such as HMAC verification secret, account registering and default user roles can be updated, which could result in site takeover.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00632 · 49.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-11-17T10:15Z
EPSS history
Timeline
  • 17 NOV 10:15Z
    Simple JWT Login < 3.2.1 - Arbitrary Settings Update to Site Takeover via CSRF
    cvelistv5