Ultimate Product Catalog, CVE-2021-24993

CVE, Research URL: CVE-2021-24993
Home page URL: Security reports for Ultimate Product Catalog
Application: Ultimate Product Catalog
Published on: Feb 07, 2022
Research Description: The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
Affected versions: max 2.1.1.
Status: vulnerable