Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2021-25084

Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisation checks in some of their AJAX actions, allowing any authenticated users, such as subscriber to call them and add or remove events as well as schedules for example

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Advanced Cron Manager

  • 2.4.2 to < 2.4.2affected

Unknown Advanced Cron Manager Pro

  • 2.5.3 to < 2.5.3affected

References