CVE-2021-24635
Medium
Description
The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL
SeverityMedium
CVSS5.4
Exploit probability—
ProductBootstrapped Visual Link Preview
PublishedSep 20, 2021
First seenSep 20, 2021
Weakness typeCWE-284Improper access control
How to fix
Update
- bootstrapped visual_link_preview2.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bootstrapped visual_link_preview | v < 2.2.3 | 2.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.