CVE-2021-4360: The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting…

PriorityP357high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

1.15%

63.0th percentile

The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
waseem_senjer	controlled_admin_access	< 1.5.6	1.5.6
wpruby	controlled_admin_access	<= 1.5.5	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.