CVE-2021-24668: MAZ Loader < 1.4.1 - Arbitrary Loader Deletion via CSRF

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-23 · updated 2026-06-17
Weakness: CWE-352

Description

The MAZ Loader WordPress plugin before 1.4.1 does not enforce nonce checks, which allows attackers to make administrators delete arbitrary loaders via a CSRF attack

Affected products

MAZ Loader – Preloader Builder for WordPress: before 1.4.1 — fixed in 1.4.1

How to fix

Upgrade to a fixed version: MAZ Loader – Preloader Builder for WordPress 1.4.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/519205ff-2ff6-41e4-9e95-475ab2ce35b9
https://wpscan.com/vulnerability/519205ff-2ff6-41e4-9e95-475ab2ce35b9

Get alerted when CVE-2021-24668 or the next vulnerability affects your stack