CVE-2021-24845: improved include page project improved inclu…

csirt@kutim:~/threat-intel/cve/CVE-2021-24845

CVSS 6.5 · Medium EPSS 1,0%

Kerentanan Improper Access Control pada improved include page project improved include page. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The Improved Include Page WordPress plugin through 1.2 allows passing shortcode attributes with post_type & post_status which can be used to retrieve arbitrary content. This way, users with a role as low as Contributor can gain access to content they are not supposed to.

Rincian

Terbit di NVD: 13 Desember 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
EPSS (30 hari): 1,0% peluang dieksploitasi; lebih tinggi dari 62,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
improved include page project	improved include page	Semua versi hingga 1.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://wpscan.com/vulnerability/ab857454-7c7c-454d-9c7f-1db767961e5f exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.