CVEs-PoC/2021/CVE-2021-24356.md

CVE-2021-24356

Description

In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites.

POC

Reference

• https://wpscan.com/vulnerability/be356530-5e00-4f27-8177-b80f3c1ae6e8
• https://wpscan.com/vulnerability/be356530-5e00-4f27-8177-b80f3c1ae6e8

Github

• https://github.com/RandomRobbieBF/CVE-2021-24356