CVEs-PoC/2021/CVE-2021-24742.md

### [CVE-2021-24742](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24742)
![](https://img.shields.io/static/v1?label=Product&message=Logo%20Slider%20and%20Showcase&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.3.37%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-863%20Incorrect%20Authorization&color=brightgreen)

### Description

The Logo Slider and Showcase WordPress plugin before 1.3.37 allows Editor users to update the plugin's settings via the rtWLSSettings AJAX action because it uses a nonce for authorisation instead of a capability check.

### POC

#### Reference
- https://wpscan.com/vulnerability/8dfc86e4-56a0-4e30-9050-cf3f328ff993

#### Github
- https://github.com/20142995/nuclei-templates