CVE-2021-24892
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2021
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Advanced Forms Ppro
- Vendor
- TODO
- Product
- Advanced Forms Ppro
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.6.9 | affected | custom | 1.6.9 | Unavailable | None listed |
Advanced Forms
- Vendor
- TODO
- Product
- Advanced Forms
- Platforms
- Unknown
- Default status
Unknown
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 1.6.9 | affected | custom | 1.6.9 | Unavailable | None listed |