Vulnerability · Published Jan 24, 2022 · Assigned by WPScan
CVE-2021-24906Protect WP Admin < 3.6.2 - Unauthenticated Plugin Deactivation
High 7.5
In plain English
A high-severity missing authorization in Protect WP Admin from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.5%top 25.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Protect WP Admin | 3.6.2 – before 3.6.2 |
Weakness: CWE-862