cbcvebase.
CVE-2021-25032
published 2022-01-10

CVE-2021-25032: The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF…

PriorityP182critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.74%
93.2th percentile
The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticated attackers could update arbitrary blog options, such as the default role and make any new registered user with an administrator role.

Affected

1 ranges
VendorProductVersion rangeFixed in
publishpresscapabilities< 2.3.12.3.1

Detection & IOCsextracted from sources · hover to see the quote

otherPublishPress Capabilities < 2.3.1↗
sigma
status: 200 response on PublishPress Capabilities settings update endpoint (unauthenticated)
  • →Unauthenticated POST requests targeting the WordPress init hook to update arbitrary blog options (e.g., default_role set to administrator) should be flagged — no authentication or CSRF token required by the vulnerable plugin. ↗
  • →Monitor for changes to the WordPress 'default_role' option being set to 'administrator', which is the primary impact of successful exploitation. ↗
  • →Nuclei/automated scanner fingerprint for this CVE returns HTTP 200; monitor for automated exploitation attempts matching this pattern against WordPress sites running PublishPress Capabilities.
  • ·The vulnerability is triggered via the WordPress 'init' hook, meaning the malicious option-update request does not require authentication or a valid CSRF nonce — standard WordPress nonce/CSRF defenses are bypassed entirely. ↗
  • ·The exploit is not limited to plugin-owned options; arbitrary blog options can be overwritten, broadening the attack surface beyond just role assignment. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.