Riskcovery

CVE-2021-24752

Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change

State
Published
Severity
Not scored
Published
Oct 18, 2021
Updated
Aug 3, 2024
Reserved
Jan 14, 2021

Read the record on cve.org

Description

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.

Scores

The record has no CVSS score.

Weaknesses

Affected Products

ProductVersions
Essential WidgetsCatchThemes
  • 1.9 to before 1.9Affected
To TopCatchThemes
  • 2.3 to before 2.3Affected
Header EnhancementCatchThemes
  • 1.5 to before 1.5Affected
Generate Child ThemeCatchThemes
  • 1.6 to before 1.6Affected
Essential Content TypesCatchThemes
  • 1.9 to before 1.9Affected
Catch Web ToolsCatchThemes
  • 2.7 to before 2.7Affected
Catch Under ConstructionCatchThemes
  • 1.4 to before 1.4Affected
Catch Themes Demo ImportCatchThemes
  • 1.6 to before 1.6Affected
Catch Sticky MenuCatchThemes
  • 1.7 to before 1.7Affected
Catch Scroll Progress BarCatchThemes
  • 1.6 to before 1.6Affected
Social Gallery and WidgetCatchThemes
  • 2.3 to before 2.3Affected
Catch Infinite ScrollCatchThemes
  • 1.9 to before 1.9Affected
Catch Import ExportCatchThemes
  • 1.9 to before 1.9Affected
Catch GalleryCatchThemes
  • 1.7 to before 1.7Affected
Catch Duplicate SwitcherCatchThemes
  • 1.6 to before 1.6Affected
Catch BreadcrumbCatchThemes
  • 1.7 to before 1.7Affected
Catch IDsCatchThemes
  • 2.4 to before 2.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.