Exploit for CVE-2021-24207

cve · 2021-04-05

Description

The WP Page Builder WordPress plugin before 1.2.4 allows unauthorized editing of posts/pages

Entry point

Parameterpost · query param

Pathwp-admin/post.php?post=610&action=wppb_editor

Subscriber-level users can access the editor by visiting the post editor URL with action=wppb_editor, enabling edit/delete of posts/pages.

Affected Themeum Wp Page Builder versions

Themeum Wp Page Builder< 1.2.4

All known vulnerabilities by product

Wp Page Builder

CVSS 4.3 for CVE-2021-24207

4.3

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:LOW

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:NONE

Integrity:LOW

Availability:NONE

EPSS Score

0.7%higher than 49.4% of all CVEs

Updated 2026-08-12

CVE Information

CVE-2021-24207

References

https://wpscan.com/vulnerability/21e7a46f-e9a3-4b20-b44a-a5b6ce7b7ce6

https://www.themeum.com/wp-page-builder-updated-v1-2-4/

Exploit Details

Modified:2026-06-17 03:39

Last Seen:2026-07-15 10:50

Reporter:WPScan

Other exploits for CVE-2021-24207

WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts

2021-03-17 Ramuel GallWPEXPLOIT

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=CVE-2021-24207
By default, the WP Page Builder WordPress plugin before 1.2.4 allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages.

Exploit Code

Share

Share on social media: