1. Home
  2. CVE Database
  3. CVE-2021-24806
MEDIUM · 4.3

CVE-2021-24806

The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary co...

Vulnerability Description

The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary comment.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
NONE
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
GvectorsWpdiscuz< 7.3.4

Related Weaknesses (CWE)

CWE-352

References

FAQ

What is CVE-2021-24806?

CVE-2021-24806 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary co...

How severe is CVE-2021-24806?

CVE-2021-24806 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-24806?

Check the references section above for vendor advisories and patch information. Affected products include: Gvectors Wpdiscuz.