CVE-2021-24781: Image Source Control < 2.3.1 - Contributor+ Arbitrary Post Meta Value Change

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-01 · updated 2026-06-17
Weakness: CWE-284

Description

The Image Source Control WordPress plugin before 2.3.1 allows users with a role as low as Contributor to change arbitrary post meta fields of arbitrary posts (even those they should not be able to edit)

Affected products

Thomas Maier Image Source Control Lite – Show Image Credits and Captions: before 2.3.1 — fixed in 2.3.1

How to fix

Upgrade to a fixed version: Thomas Maier Image Source Control Lite – Show Image Credits and Captions 2.3.1. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2606615/
https://wpscan.com/vulnerability/3550ba54-7786-4ad9-aeb1-1c0750f189d0
https://plugins.trac.wordpress.org/changeset/2606615/
https://wpscan.com/vulnerability/3550ba54-7786-4ad9-aeb1-1c0750f189d0

Get alerted when CVE-2021-24781 or the next vulnerability affects your stack