CVE-2021-24892: Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR
Vulnerability summary
CVE-2021-24892 is a high (CVSS 8.8) vulnerability in advanced_forms_project advanced_forms. EPSS estimates a 1.86% chance of exploitation in the next 30 days, higher than 79% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 23-11-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.86%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.86% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Todo2 products
- advanced forms≥ 1.6.9, < 1.6.9
- advanced forms ppro≥ 1.6.9, < 1.6.9
Advanced_forms_project1 product
- advanced_forms< 1.6.9
Wordpress1 product
- advanced-forms< 1.6.9
3 vendors · 4 products
References
3 links- wpscan.com/vulnerability/364b0843-a990-4204-848a-60c928cc5bc0X Refsource MISCExploitThird Party Advisory
- github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2X Refsource MISCPatchThird Party Advisory