CVEvulnerability
CVE-2021-24289
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-05-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-269
Description
There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.
Affected configurations
• de-baat store locator plus (<= 5.5.14)
Related
Weakness · CWE (1)
- CWE-269 Improper Privilege Management weakness
References
- https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62 Third Party Advisory
- https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/ Third Party Advisory
- https://wpscan.com/vulnerability/078e93cd-7cf2-4e23-8171-58d44e354d62 Third Party Advisory
- https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin/ Third Party Advisory