CVE-2021-24230

The Jetpack Scan team identified a Cross-Site Request Forgery vulnerability in the Patreon WordPress plugin before 1.7.0, allowing attackers to make a logged in user overwrite or create arbitrary user metadata on the victim’s account once visited. If exploited, this bug can be used to overwrite the “wp_capabilities” meta, which contains the affected user account’s roles and privileges. Doing this would essentially lock them out of the site, blocking them from accessing paid content.

• CWE-352
• CWE-352

• https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/2deefa2d-3043-42e5-afef-a42c37703531Third Party Advisory
• https://jetpack.com/2021/03/26/vulnerabilities-found-in-patreon-wordpress-plugin/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/2deefa2d-3043-42e5-afef-a42c37703531Third Party Advisory

Published

Apr 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-24225The Advanced Booking Calendar WordPress plugin before 1.6.7 …5.4
• CVE-2021-24226In the AccessAlly WordPress plugin before 3.5.7, the file "r…7.5
• CVE-2021-24227The Jetpack Scan team identified a Local File Disclosure vul…7.5
• CVE-2021-24228The Jetpack Scan team identified a Reflected Cross-Site Scri…9.6
• CVE-2021-24229The Jetpack Scan team identified a Reflected Cross-Site Scri…9.6
• CVE-2021-2423Vulnerability in the Oracle Outside In Technology product of…7.5
• CVE-2021-24231The Jetpack Scan team identified a Cross-Site Request Forger…6.5
• CVE-2021-24232The Advanced Booking Calendar WordPress plugin before 1.6.8 …5.4
• CVE-2021-24233The Cooked Pro WordPress plugin before 1.7.5.6 was affected …6.1
• CVE-2021-24234The Search Forms page of the Ivory Search WordPress lugin be…6.1
• CVE-2021-24235The Goto WordPress theme before 2.0 does not sanitise the ke…6.1
• CVE-2021-24236The Imagements WordPress plugin through 1.2.5 allows images …9.8