cbcvebase.
CVE-2021-36888
published 2021-12-15

CVE-2021-36888: Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1)…

PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
6.74%
93.1th percentile
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.

Affected

2 ranges
VendorProductVersion rangeFixed in
blockseraimage_hover_effects< 9.6.19.6.1
oxilabimage_hover_effects_ultimate<= 9.6.1—

Detection & IOCsextracted from sources · hover to see the quote

url/wp-json/ImageHoverUltimate/v1/oxi_settings↗
otherrawdata=%7B%22name%22%3A%22blogname%22%2C%22value%22%3A%22{{rand}}%22%7D↗
otheroxi-confirmation-success↗
  • →Detect unauthenticated POST requests to the vulnerable REST API endpoint /wp-json/ImageHoverUltimate/v1/oxi_settings with no authentication headers. ↗
  • →Successful exploitation returns HTTP 200 with the string 'oxi-confirmation-success' in the response body. ↗
  • →Requests include the header X-Requested-With: XMLHttpRequest and Content-Type: application/x-www-form-urlencoded targeting the oxi_settings endpoint. ↗
  • →The POST body contains a JSON-encoded 'rawdata' parameter used to overwrite arbitrary WordPress options (e.g., blogname), URL-encoded as rawdata=%7B%22name%22%3A... ↗
  • ·Vulnerability affects Image Hover Effects Ultimate plugin versions <= 9.6.1 only; patched versions are not vulnerable. ↗
  • ·The nuclei template is marked 'intrusive' — sending the exploit modifies live WordPress site options (e.g., blogname). Use only in authorized testing environments. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.