CVE-2021-24251 Business Directory Plugin < 5.11.2 - Arbitrary Payment History Update

2021-05-0518:39:43

CWE-352

WPScan

www.cve.org

AI Score

Confidence

High

EPSS

0.001

Percentile

27.4%

JSON

The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status (from pending to completed to example)

CNA Affected

[
  {
    "product": "Business Directory Plugin – Easy Listing Directories for WordPress",
    "vendor": "Business Directory Team",
    "versions": [
      {
        "lessThan": "5.11.2",
        "status": "affected",
        "version": "5.11.2",
        "versionType": "custom"
      }
    ]
  }
]