VULNERABILITY INTELLIGENCE

CVE-2021-24842

CVSS score5.4 MEDIUM

EPSS probability0.72%

CISA KEVNot currently listed

Published2021-11-29

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Description

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1) list private post titles of other users and 2) change the posted date of other users' posts.

Weakness classification

contact@wpscan.com: CWE-862
nvd@nist.gov: CWE-863

Primary references

contact@wpscan.com — Release Notes, Third Party Advisory
contact@wpscan.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory