CVE-2021-25084

CVE-2021-25084 describes an authorization bypass vulnerability in the Advanced Cron Manager and Advanced Cron Manager Pro WordPress plugins prior to versions 2.4.2 and 2.5.3, respectively. Authenticated users, even those with subscriber privileges, could exploit this flaw due to missing authorization checks in certain AJAX actions. This allowed them to add or remove cron events and schedules, potentially disrupting website operations. The vulnerability has a CVSS v3.1 score of 4.3 (Medium), indicating a network-based attack with low attack complexity and requiring low privileges, resulting in a low impact on integrity and no impact on confidentiality or availability. While the potential impact is limited to integrity, the ease of exploitation by any authenticated user makes it a concern. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention from researchers or threat actors.