First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2021-25097

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352 CWE-863

Affected software

Vendor	Product	Versions
Unknown	LabTools	>= 1.0, <= 1.0

References

https://wpscan.com/vulnerability/67f5beb8-2cb0-4b43-87c7-dead9c005f9cThird Party Advisory
https://wpscan.com/vulnerability/67f5beb8-2cb0-4b43-87c7-dead9c005f9cThird Party Advisory

Timeline

Published: Feb 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-250986.5The Pricing Tables WordPress Plugin WordPress plugin before 3.1.3 does not verify the CSRF nonce when removing posts, allowing attackers to CVE-2021-250996.1The GiveWP WordPress plugin before 2.17.3 does not sanitise and escape the form_id parameter before outputting it back in the response of an CVE-2021-251006.1The GiveWP WordPress plugin before 2.17.3 does not escape the s parameter before outputting it back in an attribute in the Donation Forms da CVE-2021-251014.8The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.94 does not sanitise and escape the POST data before outputt CVE-2021-251024.7The All In One WP Security & Firewall WordPress plugin before 4.4.11 does not validate, sanitise and escape the redirect_to parameter before CVE-2021-251034.7The Translate WordPress with GTranslate WordPress plugin before 2.9.7 does not sanitise and escape the body parameter in the url_addon/gtran CVE-2021-251046.1The Ocean Extra WordPress plugin before 1.9.5 does not escape generated links which are then used when the OceanWP is active, leading to a R CVE-2021-251054.8The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform CVE-2021-251065.4The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WPLegalPages WordPress plugin before 2.7.1 does not check for CVE-2021-251076.1The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entr CVE-2021-251087.1The IP2Location Country Blocker WordPress plugin before 2.26.6 does not have CSRF check in the ip2location_country_blocker_save_rules AJAX a CVE-2021-251092.7The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to e