Read the docs
TI-2021-03217 Aliases CVE-2021-4360GHSA-6p6c-8qqm-q7cx

Controlled Admin Access < 1.5.6 - Privilege Escalation

Priority MEDIUM 45CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

The Controlled Admin Access plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.5 by not properly restricting access to the configuration page. This makes it possible for attackers to create a new administrator role with unrestricted access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01153 67th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Controlled Admin Access (waseem_senjer): 1.5.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
waseem_senjerControlled Admin Accessbefore 1.5.61.5.6Patch availableCNA
  • Controlled Admin Access Vendorwaseem_senjer Affected before 1.5.6 Fixed in 1.5.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpruby:controlled_admin_access:*:*:*:*:*:wordpress:*:*up to 1.5.5VulnerableWpruby
  • cpe:2.3:a:wpruby:controlled_admin_access:*:*:*:*:*:wordpress:*:* Versions up to 1.5.5 Vulnerable ·Wpruby

Remediation

  • Fix · CNA Controlled Admin Access (waseem_senjer) Fixed in 1.5.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4360
  2. 2026-10-03 Alias added: GHSA-6p6c-8qqm-q7cx

References

Exploit 2

Advisory 1

Other 1

  • TI-2021-06507 Controlled Admin Access < 1.5.2 - Improper Access Control & Privilege Escalation CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences