CVE-2021-24809 in BP Better Messages Plugin信息

摘要

由 VulDB • 2026-06-03

BP Better Messages WordPress 插件在版本低于 1.9.9.41 时，未对其多个 AJAX 操作（包括 `bp_better_messages_leave_chat`、`bp_better_messages_join_chat`、`bp_messages_leave_thread`、`bp_messages_mute_thread`、`bp_messages_unmute_thread`、`bp_better_messages_add_user_to_thread` 和 `bp_better_messages_exclude_user_from_thread`）进行 CSRF（跨站请求伪造）检查。这可能导致攻击者诱使已登录用户执行非预期的操作。

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

预定

2021-01-14

披露

2021-11-01

管理

已接受

条目

VDB-185846

CPE

20211101

CWE

CWE-352 (已确认)

CVSS

8.8 (NVD)

EPSS

0.00726

KEV

否

活动

非常低

部门

Hostingprovider

来源

MITRE	https://www.cve.org/CVERecord?id=CVE-2021-24809
NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-24809
CVE Details	https://www.cvedetails.com/cve/CVE-2021-24809/

◂ 上一步一览下一步 ▸

Do you need the next level of professionalism?

Upgrade your account now!