Not rated
CVE-2021-24968 The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the…
Description
The Ultimate FAQ WordPress plugin before 2.1.2 does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ultimate FAQ – WordPress FAQ and Accordion Plugin 2.1 | earliest → < 2.1.2 | 2.1.2 |