CVE-2021-24906

HIGH 7.5CVE-2021-24906 · Published 24/01/2022 · updated 17/06/2026

In short

CVE-2021-24906 is a HIGH (CVSS 7.5) vulnerability affecting protect wp admin (wp-experts).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.2% of all vulnerabilities.
Fix: update to 3.6.2 or later.

Package	Affected versions	Patched versions
protect wp admin wp-experts	`< 3.6.2`	`3.6.2`

Description

The Protect WP Admin WordPress plugin before 3.6.2 does not check for authorisation in the lib/pwa-deactivate.php file, which could allow unauthenticated users to disable the plugin (and therefore the protection offered) via a crafted request

References

wpscan.com/vulnerability/4204682b-f657-42e1-941c-bee7a245e9fd · Exploit

More vulnerabilities in protect wp admin

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free