← CVE Intelligence

CVE-2021-24633

Countdown Block < 1.1.2 - Missing Authorisation in AJAX action PUBLISHED

Description (CNA)

The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users.

Affected (CNA)

Vendor / productVersions
Unknown / Countdown Blockaffected 1.1.2 before 1.1.2

CWE

CWE-862

References

ADP enrichment

CVE

No English description supplied.