CVE-2021-24507

CRITICAL 9.8CVE-2021-24507 · Published 09/08/2021 · updated 17/06/2026

In short

CVE-2021-24507 is a CRITICAL (CVSS 9.8) vulnerability affecting astra (brainstormforce).
Chance of exploitation in the next 30 days (EPSS): 11.0%, higher than 95.9% of all vulnerabilities.
Fix: update to 3.5.2 or later.

Package	Affected versions	Patched versions
astra brainstormforce	`< 3.5.2`	`3.5.2`

Description

The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues

References

wpastra.com/changelog/astra-pro-addon · Release Notes
wpscan.com/vulnerability/a1a0dc0b-c351-4d46-ac9b-b297ce4d251c · Exploit

More vulnerabilities in astra

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free