Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion
CVE-2021-25084

4.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Advanced Cron Manager
Advanced Cron Manager Pro
Vendor
CVE Published:
7 February 2022

What is CVE-2021-25084?

The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example

Affected Version(s)

Advanced Cron Manager 2.4.2

Advanced Cron Manager Pro 2.5.3

References

https://wpscan.com/vulnerability/7c5c602f-499f-431b-80bc-...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof ZajÄ…c
.
CVE-2021-25084 : Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion