CVE-2021-24803

HIGH 8.8CVE-2021-24803 · Published 28/02/2022 · updated 17/06/2026

In short

CVE-2021-24803 is a HIGH (CVSS 8.8) vulnerability affecting core tweaks wp setup (core tweaks wp setup project).
Chance of exploitation in the next 30 days (EPSS): 0.63%, higher than 50.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
core tweaks wp setup core_tweaks_wp_setup_project	`≤ 4.1`	No fix yet

Description

The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks

References

wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free