VYPR
← All advisories
Unrated severityNVD Advisory· Published Oct 18, 2021· Updated Aug 3, 2024

Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change

CVE-2021-24752

Description

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

20
  • Catchthemes/Catch Web Toolsllm-create2 versions
    <2.7+ 1 more
    • (no CPE)range: <2.7
    • (no CPE)range: 2.7
  • FreeBSD/topllm-fuzzy
    Range: <2.3
  • WordPress/Essential Widgetsllm-fuzzy
    Range: <1.9
  • CatchThemes/Catch Breadcrumbv5
    Range: 1.7
  • CatchThemes/Catch Duplicate Switcherv5
    Range: 1.6
  • CatchThemes/Catch Galleryv5
    Range: 1.7
  • CatchThemes/Catch IDsv5
    Range: 2.4
  • CatchThemes/Catch Import Exportv5
    Range: 1.9
  • CatchThemes/Catch Infinite Scrollv5
    Range: 1.9
  • CatchThemes/Catch Scroll Progress Barv5
    Range: 1.6
  • CatchThemes/Catch Sticky Menuv5
    Range: 1.7
  • CatchThemes/Catch Themes Demo Importv5
    Range: 1.6
  • CatchThemes/Catch Under Constructionv5
    Range: 1.4
  • CatchThemes/Essential Content Typesv5
    Range: 1.9
  • CatchThemes/Essential Widgetsv5
    Range: 1.9
  • CatchThemes/Generate Child Themev5
    Range: 1.6
  • CatchThemes/Header Enhancementv5
    Range: 1.5
  • CatchThemes/Social Gallery and Widgetv5
    Range: 2.3
  • CatchThemes/To Topv5
    Range: 2.3

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.