CVE-2021-4448

moderate-risk
Published 2024-10-16

The Kaswara Modern VC Addons plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.0.1 due to insufficient capability checking on various AJAX actions. This makes it possible for unauthenticated attackers to perform a wide variety of unauthorized actions such as importing data, uploading arbitrary files, deleting arbitrary files, and more.

Do I need to act?

!
48.9% chance of exploitation in next 30 days
EPSS score — higher than 51% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.3/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Kaswara Project

References (2)

Not Applicable https://codecanyon.net/item/kaswara-modern-visual-composer-addons/19341477
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/3bf76527-9a11-4755-992...
49
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 18/34 · Moderate
Exposure 5/34 · Minimal