Monitor free

Report

New Known

Fixed

Exploited

WordPress Image Hover Effects Ultimate plugin <= 9.6.1 - Unauthenticated Arbitrary Options Update leading to full website compromise

9.8

CVSS 3.1 score Critical severity

Monitoring Known to be exploited

Find out about vulnerable plugins in your websites for free.

Scan your website

Software

Image Hover Effects Ultimate

Type

Plugin

Vulnerable versions

<= 9.6.1

Fixed in

9.6.2

PSID

7c11431b6f44

CVE ID

CVE-2021-36888

Classification

Other Vulnerability Type

OWASP Top 10

A5: Broken Access Control

Required privilege

Can be exploited remotely without any authentication.

Credits

John Castro (Pagely)

Publicly disclosed

2021-12-15

Patchstack vPatch available since

09.12.2021

Details

Unauthenticated Arbitrary Options Update leading to full website compromise discovered by mirphak aka John Castro (Pagely) in WordPress Image Hover Effects Ultimate plugin (versions <= 9.6.1).

Solution

Update the WordPress Image Hover Effects Ultimate plugin to the latest available version (at least 9.6.2)

References