CVE-2021-24380

CVE-2021-24380: Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF

Vendor Unknown
Product Shantz WordPress QOTD
Weakness CWE-352 · CSRF
Published August 16, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.

Key dates

02Disclosure timeline

August 16, 2021 CVE published
August 3, 2024 Record updated