Riskcovery

CVE-2021-25084

Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion

State
Published
Severity
Not scored
Published
Feb 7, 2022
Updated
Aug 3, 2024
Reserved
Jan 14, 2021

Read the record on cve.org

Description

The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example

Scores

The record has no CVSS score.

Weaknesses

Affected Products

ProductVersions
Advanced Cron ManagerUnknown
  • 2.4.2 to before 2.4.2Affected
Advanced Cron Manager ProUnknown
  • 2.5.3 to before 2.5.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.