What’s Vulnerable › Vulnerabilities

CVE-2021-24752: Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting Change

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-10-18 · updated 2026-06-17
• Weakness: CWE-284

Description

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essential Widgets WordPress plugin before 1.9, To Top WordPress plugin before 2.3, Header Enhancement WordPress plugin before 1.5, Generate Child Theme WordPress plugin before 1.6, Essential Content Types WordPress plugin before 1.9, Catch Web Tools WordPress plugin before 2.7, Catch Under Construction WordPress plugin before 1.4, Catch Themes Demo Import WordPress plugin before 1.6, Catch Sticky Menu WordPress plugin before 1.7, Catch Scroll Progress Bar WordPress plugin before 1.6, Social Gallery and Widget WordPress plugin before 2.3, Catch Infinite Scroll WordPress plugin before 1.9, Catch Import Export WordPress plugin before 1.9, Catch Gallery WordPress plugin before 1.7, Catch Duplicate Switcher WordPress plugin before 1.6, Catch Breadcrumb WordPress plugin before 1.7, Catch IDs WordPress plugin before 2.4's configurations.

Affected products

• catchplugins Catch Scroll Progress Bar: before 1.6 — fixed in 1.6
• catchplugins Catch Sticky Menu: before 1.7 — fixed in 1.7
• Catch Themes Demo Import: before 1.6 — fixed in 1.6
• catchplugins Catch Under Construction: before 1.4 — fixed in 1.4
• catchplugins Catch Web Tools: before 2.7 — fixed in 2.7
• catchplugins Essential Content Types: before 1.9 — fixed in 1.9
• catchplugins Essential Widgets: before 1.9 — fixed in 1.9
• catchplugins Generate Child Theme: before 1.6 — fixed in 1.6
• catchplugins Header Enhancement: before 1.5 — fixed in 1.5
• catchplugins To Top: before 2.3 — fixed in 2.3

How to fix

Upgrade to a fixed version: catchplugins Catch Scroll Progress Bar 1.6; catchplugins Catch Sticky Menu 1.7; Catch Themes Demo Import 1.6; catchplugins Catch Under Construction 1.4; catchplugins Catch Web Tools 2.7; catchplugins Essential Content Types 1.9; catchplugins Essential Widgets 1.9; catchplugins Generate Child Theme 1.6; catchplugins Header Enhancement 1.5; catchplugins To Top 2.3. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/181a729e-fffe-457c-9e8d-a4343fd2e630
• https://wpscan.com/vulnerability/181a729e-fffe-457c-9e8d-a4343fd2e630

Get alerted when CVE-2021-24752 or the next vulnerability affects your stack