What’s Vulnerable › Vulnerabilities

CVE-2021-4360: Controlled Admin Access < 1.5.6 - Privilege Escalation

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-06-07 · updated 2026-06-17
• Weakness: CWE-284

Description

The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.

Affected products

• Controlled Admin Access: through 1.5.5

References

• https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin/
• https://plugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txt
• https://wpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379c
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=cve
• https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin/
• https://plugins.svn.wordpress.org/controlled-admin-access/trunk/readme.txt
• https://wpscan.com/vulnerability/5ddc0a9d-c081-4bef-aa87-3b10d037379c
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8c57211a-f59d-4379-b09e-7c6049a6b04d?source=cve

Get alerted when CVE-2021-4360 or the next vulnerability affects your stack