CVE-2021-24993CWE-862

Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update

published February 7, 2022

CVSS
—
EPSS
0%
Percentile
39.6
In the wild
Unconfirmed
What it is

The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00469 · 39.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-02-07T15:47Z
EPSS history
Timeline
  • 07 FEB 15:47Z
    Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update
    cvelistv5