CVE-2021-4360
Controlled Admin Access < 1.5.6 - Privilege Escalation
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.9EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
07 Jun 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
waseem_senjer · Controlled Admin AccessWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin/https://plugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txthttps://wpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379chttps://www.wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=cve