CVE-2021-24803

Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF

State: Published
Severity: Not scored
Published: Feb 28, 2022
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks

Scores

The record has no CVSS score.

Weaknesses

CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
Core Tweaks WP SetupUnknown	4.1 through 4.1Affected

References

https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.