CVE-2021-24853CWE-284

QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update

published November 17, 2021

CVSS
—
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2021-11-17T10:15Z
EPSS history
Timeline
  • 17 NOV 10:15Z
    QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update
    cvelistv5