Vulnerability · Published Apr 5, 2021 · Assigned by WPScan
CVE-2021-24207WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts
Medium 4.3
In plain English
A medium-severity incorrect authorization in WP Page Builder from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS NVD)4.3Medium
Exploit odds (30 days)0.7%top 47.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Page Builder | 1.2.4 – before 1.2.4 |
Weakness: CWE-863
References
- https://wpscan.com/vulnerability/21e7a46f-e9a3-4b20-b44a-a5b6ce7b7ce6 x_refsource_CONFIRM
- https://www.themeum.com/wp-page-builder-updated-v1-2-4/ x_refsource_MISC