CVE-2021-24215

published 2021-04-12

CVE-2021-24215: An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website…

Priority P2 68 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
wpruby	controlled_admin_access	< 1.5.2	1.5.2

Detection & IOCs extracted from sources · hover to see the quote

path /wp-admin/options.php↗

path /wp-admin/customization.php↗

path /wp-content/plugins/controlled-admin-access/

sigma

status_code_2 == 200 AND contains(content_type_2, 'text/html') AND contains(body_2, 'This page allows direct access to your site settings') AND contains(body_2, 'Controlled Admin Access')

• → Detect exploitation attempts by monitoring HTTP GET requests to /wp-admin/options.php returning HTTP 200 with body containing 'This page allows direct access to your site settings' and 'Controlled Admin Access' — indicating unauthorized access to WordPress global settings via the vulnerable plugin.
• → Fingerprint vulnerable WordPress installations by searching for the plugin path /wp-content/plugins/controlled-admin-access/ in HTTP response bodies (Shodan: http.html:/wp-content/plugins/controlled-admin-access/, FOFA: body=/wp-content/plugins/controlled-admin-access/).
• → The attack flow involves two requests: (1) POST to /wp-login.php to authenticate, followed by (2) GET to /wp-admin/options.php — monitor for low-privilege or guest accounts successfully accessing /wp-admin/options.php.

• · The Nuclei template is marked 'authenticated' — exploitation requires valid (low-privilege) WordPress credentials; the vulnerability is improper access control (CWE-284/CWE-425), not unauthenticated access, despite the CVSS PR:N score.
• · Affected versions are <= 1.4.0; the fix was introduced in version 1.5.2. Ensure version checks target the correct range when deploying detection rules.
• · The template requires exactly 2 HTTP requests (max-request: 2); detection logic depends on the second response (status_code_2, content_type_2, body_2), meaning single-request scanners will miss the confirmation step.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284 CWE-425