CVE-2021-24230: patreon patreon wordpress Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2021-24230 is a high (CVSS 8.1) Cross-Site Request Forgery (CSRF) vulnerability in patreon patreon wordpress. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.5% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.7.0.

Timeline

1. 12-04-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.