What’s Vulnerable › Vulnerabilities

CVE-2021-24842: Bulk Datetime Change < 1.12 - Missing Authorisation

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-29 · updated 2026-06-17
• Weakness: CWE-862

Description

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.

Affected products

• Bulk Datetime Change: before 1.12 — fixed in 1.12

How to fix

Upgrade to a fixed version: Bulk Datetime Change 1.12. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2618982
• https://wpscan.com/vulnerability/054bd981-dbdd-47dd-bad0-fa327e5860a2
• https://plugins.trac.wordpress.org/changeset/2618982
• https://wpscan.com/vulnerability/054bd981-dbdd-47dd-bad0-fa327e5860a2

Get alerted when CVE-2021-24842 or the next vulnerability affects your stack