CVE-2021-24188

CVE-2021-24188: WP Content Copy Protection & No Right Click < 3.1.5 - Arbitrary Plugin Installation/Activation via Low Privilege User

Vendor Wp-Buy
Product WP Content Copy Protection & No Right Click
Weakness CWE-285
Published May 14, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Low privileged users can use the AJAX action 'cp_plugins_do_button_job_later_callback' in the WP Content Copy Protection & No Right Click WordPress plugin before 3.1.5, to install any plugin (including a specific version) from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install vulnerable plugins and could lead to more critical vulnerabilities like RCE.

Key dates

02Disclosure timeline

May 14, 2021 CVE published
August 3, 2024 Record updated