CVE-2021-4360 | The Controlled Admin Access plugin for WordPress is vulnerab… | CVSS 9.9 CRITICAL

Description

The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.

Metadata

CVE ID: CVE-2021-4360
State: PUBLISHED
Assigner: Wordfence
Reserved: 2023-06-06 12:53 UTC
Published: 2023-06-07 01:51 UTC
Last updated: 2026-04-08 17:05 UTC
Primary CWE: CWE-284
CWE-284 Improper Access Control
Vendor / Product: waseem_senjer / Controlled Admin Access
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
waseem_senjer	Controlled Admin Access	—	0 < 1.5.6

Weakness (CWE)

CWE	Source	Description
CWE-284	cna	CWE-284 Improper Access Control

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (4)