CVE-2021-36888 CRITICAL

CVE-2021-36888: WordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromise

Vendor Oxilab
Product Image Hover Effects Ultimate (WordPress plugin)
Weakness CWE-284
Published December 15, 2021
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.

Explanation of Vulnerability in Simple Terms

02Summary

The Image Hover Effects Ultimate WordPress plugin through version 9.6.1 contains an access control flaw that allows unauthenticated attackers to read, modify, or delete site data without logging in. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update immediately to a version newer than 9.6.1.

What an attacker can do

03Attacker Capabilities

Read, modify, or delete site data without authentication.

Potential impact on your site

04Site Impact

Attackers can compromise your site's data and functionality without needing a user account.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

December 15, 2021 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-64796 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension CVE-2026-0844 Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field CVE-2026-48958 Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints CVE-2026-48956 Joomla! Core - [20260710] - Incorrect Access Control in com_modules CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla