What’s Vulnerable › Vulnerabilities

CVE-2021-24215: Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-12 · updated 2026-06-17
• Weakness: CWE-284

Description

An Improper Access Control vulnerability was discovered in the Controlled Admin Access WordPress plugin before 1.5.2. Uncontrolled access to the website customization functionality and global CMS settings, like /wp-admin/customization.php and /wp-admin/options.php, can lead to a complete compromise of the target resource.

Affected products

• Controlled Admin Access: before 1.5.2 — fixed in 1.5.2

How to fix

Upgrade to a fixed version: Controlled Admin Access 1.5.2. Check the vendor advisory for mitigations.

References

• https://m0ze.ru/vulnerability/%5B2021-03-18%5D-%5BWordPress%5D-%5BCWE-284%5D-Controlled-Admin-Access-WordPress-Plugin-v1.4.0.txt
• https://wpscan.com/vulnerability/eec0f29f-a985-4285-8eed-d1855d204a20
• https://m0ze.ru/vulnerability/%5B2021-03-18%5D-%5BWordPress%5D-%5BCWE-284%5D-Controlled-Admin-Access-WordPress-Plugin-v1.4.0.txt
• https://wpscan.com/vulnerability/eec0f29f-a985-4285-8eed-d1855d204a20

Get alerted when CVE-2021-24215 or the next vulnerability affects your stack