CVE-2021-24890
High
Description
The Scripts Organizer WordPress plugin before 3.0 does not have capability and CSRF checks in the saveScript AJAX action, available to both unauthenticated and authenticated users, and does not validate user input in any way, which could allow unauthenticated users to put arbitrary PHP code in a file
SeverityHigh
CVSS8.8
Exploit probability—
ProductDplugins Scripts Organizer
PublishedSep 26, 2022
First seenSep 26, 2022
How to fix
Update
- dplugins scripts_organizer3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dplugins scripts_organizer | v < 3.0 | 3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.