CVE-2021-4360: The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This mak...

Summary

The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
wpruby	controlled_admin_access	<= 1.5.5 `cpe:2.3:a:wpruby:controlled_admin_access::::::wordpress::*`

Original advisory text

The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This mak...

The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.

References

https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-... Exploit
https://plugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txt Release Notes
https://wpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379c Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09... Third Party Advisory