VULNERABILITY INTELLIGENCE

CVE-2021-36888

CVSS score9.8 CRITICAL

EPSS probability6.53%

CISA KEVNot currently listed

Published2021-12-15

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.

Weakness classification

CWE-284: Improper Access Control
CWE-306: Missing Authentication for Critical Function

Primary references

audit@patchstack.com — Third Party Advisory
audit@patchstack.com — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory