CVE-2021-4448
Kaswara Modern VC Addons <= 3.0.1 - Missing Authorization
Vexday Risk Score
36Atención
Decisión SSVC (CISA)
Attend
PoC disponible → seguir de cerca
CVSS 7.3EPSS 1.3%KEV nãoPoC —Nuclei simMetasploit —Patch —
Ciclo de vida
16 oct 2024Publicada en NVD
Recomendación: Planificar corrección próxima — ya existe PoC pública.
The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Productos afectados
SayenThemes · Kaswara Modern VC Addons¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →