CVEvulnerability
CVE-2021-4360
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-06-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.9 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-284
Description
The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.
Affected configurations
• wpruby controlled admin access (<= 1.5.5)
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin/ Exploit
- https://plugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txt Release Notes
- https://wpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379c Exploit
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=cve Third Party Advisory
- https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin/ Exploit
- https://plugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txt Release Notes
- https://wpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379c Exploit
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=cve Third Party Advisory