CVE-2021-24635 : What You Need to Know

The Visual Link Preview WordPress plugin before version 2.2.3 is vulnerable to unauthorised AJAX calls due to lacking enforcement of authorization on various AJAX actions.

Understanding CVE-2021-24635

This vulnerability allows any authenticated user, including subscribers, to perform unauthorized actions by exploiting the lack of CSRF nonce enforcement in the Visual Link Preview plugin.

What is CVE-2021-24635?

The Visual Link Preview WordPress plugin before 2.2.3 doesn't properly enforce authorization on specific AJAX actions and exposes CSRF nonces to all authenticated users, enabling them to access and manipulate draft posts, title of password-protected posts, and upload images from URLs.

The Impact of CVE-2021-24635

The vulnerability poses a significant security risk as it allows unauthorized users to perform actions that should be restricted, potentially leading to unauthorized access to sensitive information and content manipulation.

Technical Details of CVE-2021-24635

The technical details of CVE-2021-24635 include:

Vulnerability Description

The flaw arises from the lack of authorization checks on critical AJAX actions within the Visual Link Preview plugin, exposing sensitive functionalities to unauthorized access.

Affected Systems and Versions

Visual Link Preview versions earlier than 2.2.3 are affected by this vulnerability, particularly impacting WordPress sites utilizing this plugin.

Exploitation Mechanism

Authenticated users, such as subscribers, can exploit the vulnerability by leveraging the exposed CSRF nonces to interact with draft posts, password-protected post titles, and image upload functionalities.

Mitigation and Prevention

To mitigate the risks associated with CVE-2021-24635, immediate steps and long-term security practices should be implemented:

Immediate Steps to Take

Update the Visual Link Preview plugin to version 2.2.3 or later to patch the vulnerability.
Monitor user activities to detect any suspicious behavior that may indicate exploitation attempts.

Long-Term Security Practices

Regularly update all WordPress plugins to their latest versions to address security vulnerabilities promptly.
Conduct security audits and penetration testing to identify and remediate potential security weaknesses in WordPress installations.

Patching and Updates

Stay informed about security advisories and CVE reports related to WordPress plugins and apply patches and updates promptly to maintain a secure website.