CVE-2021-24803: Core Tweaks WP Setup <= 4.1 - Arbitrary Admin Account Creation / Admin Email Update via CSRF

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-02-28 · updated 2026-06-17
Weakness: CWE-352

Description

The Core Tweaks WP Setup WordPress plugin through 4.1 allows to bulk-set many settings in WordPress, including the admin email, as well as creating a new admin account. There is no CSRF protection in place, allowing an attacker to arbitrary change the admin email or create another admin account and takeover the website via CSRF attacks

Affected products

Core Tweaks WP Setup: through 4.1

References

https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42
https://wpscan.com/vulnerability/97adac02-4163-48d4-ba14-0b1badfd3d42

Get alerted when CVE-2021-24803 or the next vulnerability affects your stack