CVE-2021-24226

CVE-2021-24226 is a sensitive information leakage vulnerability affecting the AccessAlly WordPress plugin prior to version 3.5.7. The vulnerability occurs when the [accessally_order_form] shortcode, present on public-facing pages, inadvertently dumps serialized server environment variables. This vulnerability carries a CVSS score of 7.5 (High), indicating a critical risk. It is easily exploitable remotely without authentication or user interaction, allowing an attacker to gain access to potentially sensitive server configuration details. The impact is primarily on confidentiality, with no direct impact on integrity or availability. While there is no evidence of active exploitation, Metasploit modules, or ExploitDB entries, Nuclei templates exist for detecting this vulnerability. Community discussion and media coverage are minimal, suggesting a lower public awareness despite its high severity.