Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update
Priority LOW 29CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Tampering
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862 and CWE-352.
Summary
The Ultimate Product Catalog WordPress plugin before 5.0.26 does not have authorisation and CSRF checks in some AJAX actions, which could allow any authenticated users, such as subscriber to call them and add arbitrary products, or change the plugin's settings for example
Why it matters now
EPSS 0.00469 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Ultimate Product Catalog – WordPress Catalog Plugin (Unknown): 5.0.26
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Ultimate Product Catalog – WordPress Catalog Plugin | 5.0.26 to before 5.0.26 | 5.0.26 | Patch available | CNA |
- Ultimate Product Catalog – WordPress Catalog Plugin VendorUnknown Affected 5.0.26 to before 5.0.26 Fixed in 5.0.26 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:etoilewebdesign:ultimate_product_catalog:*:*:*:*:*:wordpress:*:* | before 5.0.26 | Vulnerable | Etoile Web Design |
- cpe:2.3:a:etoilewebdesign:ultimate_product_catalog:*:*:*:*:*:wordpress:*:* Versions before 5.0.26 Vulnerable ·Etoile Web Design
Remediation
- Fix · CNA Ultimate Product Catalog – WordPress Catalog Plugin (Unknown) Fixed in 5.0.26
Timeline
- 2026-10-02 Threatist record created from CVE-2021-24993
- 2026-10-03 Alias added: GHSA-m49w-ph7r-f4pq
References
More Etoile Web Design Ultimate Product Catalog vulnerabilities
- TI-2023-02539 Ultimate Product Catalog < 5.2.6 - Admin+ Stored XSS CVSS 3.1MEDIUM 4.8
- TI-2017-08988 The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with… CVSS 3.0CRITICAL 9.8
- TI-2017-08989 The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component. CVSS 3.0MEDIUM 6.1
Sources
- CVE-2021-24993 · CVE Program
- CVE-2021-24993 · NVD
- FIRST EPSS
- GHSA-m49w-ph7r-f4pq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences