CVE-2021-24836: Temporary Login Without Password < 1.7.1 - Subscriber+ Plugin's Settings Update
The Temporary Login Without Password WordPress plugin before 1.7.1 does not have authorisation and CSRF checks when updating its settings, which could allows any logged-in users, such as subscribers to update them
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24836?
CVE-2021-24836 has a medium severity due to its potential for unauthorized access by logged-in users.
How do I fix CVE-2021-24836?
To fix CVE-2021-24836, update the Temporary Login Without Password WordPress plugin to version 1.7.1 or later.
What are the consequences of CVE-2021-24836?
The consequences of CVE-2021-24836 include the risk of unauthorized users being able to modify plugin settings.
Who is affected by CVE-2021-24836?
Users of the Temporary Login Without Password plugin for WordPress prior to version 1.7.1 are affected by CVE-2021-24836.
Is CVE-2021-24836 a critical vulnerability?
CVE-2021-24836 is not classified as critical but poses significant risks due to lack of authorization and CSRF checks.