CVE-2021-24853

QR Redirector < 1.6 - Subscriber+ Arbitrary QR Redirect Response Status Update

State: Published
Severity: Not scored
Published: Nov 17, 2021
Updated: Aug 3, 2024
Reserved: Jan 14, 2021

Description

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qr_save_bulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects

Scores

The record has no CVSS score.

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
QR RedirectorUnknown	1.6 to before 1.6Affected

References

https://wpscan.com/vulnerability/240bed24-0315-4bbf-ba17-e4947e5ecacb

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.