CVE-2021-24175

Katalog CVE

CVSS 9.8 · Critical EPSS 14,5%

Kerentanan Improper Authentication pada posimyth the plus addons for elementor. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.7 was being actively exploited to by malicious actors to bypass authentication, allowing unauthenticated users to log in as any user (including admin) by just providing the related username, as well as create accounts with arbitrary roles, such as admin. These issues can be exploited even if registration is disabled, and the Login widget is not active.

Rincian

Terbit di NVD

5 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

14,5% peluang dieksploitasi; lebih tinggi dari 96,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/c311feef-7041-4c21-9525-132b9bd32f89 exploit · advisory pihak ketiga
• https://www.wordfence.com/blog/2021/03/critical-0-day-in-the-plus-addons-for-elementor-allows-site-takeover/ advisory pihak ketiga
• https://posimyth.ticksy.com/ticket/2713734/ broken link