CVE-2021-24194

CVE-2021-24194 describes a critical vulnerability in the Login Protection - Limit Failed Login Attempts WordPress plugin prior to version 2.9. Low-privileged users can exploit an AJAX action to install any plugin from the WordPress repository, including specific versions, and activate arbitrary plugins already present on the blog. This allows attackers to introduce vulnerable plugins, potentially leading to more severe compromises like Remote Code Execution (RCE). With a CVSS score of 8.8 (HIGH), the vulnerability is easily exploitable over the network with low privileges and no user interaction, enabling high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.