Vulnerability · Published Feb 28, 2022 · Assigned by WPScan
CVE-2021-24803Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF
High 8.8
In plain English
A high-severity cross-site request forgery in Core Tweaks WP Setup from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.6%top 49.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Core Tweaks WP Setup | 4.1 – through 4.1 |
Weakness: CWE-352