CVE-2021-24190 | BDVDB-2026-153713 Detail

wp-buyWooCommerce Conditional Marketing Mailer

Description#

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WooCommerce Conditional Marketing Mailer WordPress plugin before 1.5.2, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-285 Improper Authorization

References#

https://wpscan.com/vulnerability/74889e29-5349-43d1-baf5-1622493be90c

Exploit#

No public exploit known

History#

Version 12021-05-14Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.