CVE-2021-24717

The AutomatorWP WordPress plugin before 1.7.6 does not perform capability checks which allows users with Subscriber roles to enumerate automations, disclose title of private posts or user emails, call functions, or perform privilege escalation via Ajax actions.

Score

CVSS 3.1 8.8 High

Status

Modified - contact@wpscan.com

Published

2021-11-01

Last modified

2024-08-03

Weaknesses

CWE-863

Affected products

• Automatorwp (Automatorwp)
• Automatorwp (Unknown)

References

• https://wpscan.com/vulnerability/5916ea42-eb33-463d-8528-2a142805c91f