Vulnerability Description
The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kaswara Project | Kaswara | <= 3.0.1 |
Related Weaknesses (CWE)
References
- https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477Not Applicable
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf76527-9a11-4755-992Third Party Advisory
FAQ
What is CVE-2021-4448?
CVE-2021-4448 is a vulnerability with a CVSS score of 7.3 (HIGH). The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This ma...
How severe is CVE-2021-4448?
CVE-2021-4448 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-4448?
Check the references section above for vendor advisories and patch information. Affected products include: Kaswara Project Kaswara.