What’s Vulnerable › Vulnerabilities

CVE-2021-24823: Support Board < 3.3.6 - Arbitrary File Deletion via CSRF

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-02-28 · updated 2026-06-17
• Weakness: CWE-352

Description

The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. For example, make an admin delete arbitrary files

Affected products

• Schiocco Support Board: before 3.3.6 — fixed in 3.3.6

How to fix

Upgrade to a fixed version: Schiocco Support Board 3.3.6. Check the vendor advisory for mitigations.

References

• https://noob3xploiter.medium.com/support-board-3-3-4-arbitrary-file-deletion-to-remote-code-execution-da4c45b45c83
• https://wpscan.com/vulnerability/1bdebd9e-a7f2-4f55-b5b0-185eb619ebaf
• https://noob3xploiter.medium.com/support-board-3-3-4-arbitrary-file-deletion-to-remote-code-execution-da4c45b45c83
• https://wpscan.com/vulnerability/1bdebd9e-a7f2-4f55-b5b0-185eb619ebaf

Get alerted when CVE-2021-24823 or the next vulnerability affects your stack