Is CVE-2021-24647 actively exploited?

Yes. CVE-2021-24647 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2021-24647 be exploited remotely?

The attack vector of CVE-2021-24647 has not been classified yet.

What is the CVSS score of CVE-2021-24647?

CVE-2021-24647 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2021-24647

UNKNOWNCISA KEVIN THE WILD

CVE-2021-24647

Published: April 11, 2026

EPSS:85.03%probability of exploitation in 30 daysPercentile:99.4th

Official Description

The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username

NVD Source

Risk Analysis

This vulnerability in the Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin allows unauthenticated attackers to log in as any user. This is possible by knowing only the user's ID or username due to a flaw in the social login implementation. The active exploitation and inclusion in CISA's KEV catalog make this a severe access control bypass.

This vulnerability is actively exploited in the wild and is included in CISA's Known Exploited Vulnerabilities catalog. The social login flaw allows unauthenticated attackers to log in as any user, making it remotely exploitable.

Recommended Action

Upgrade the Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin to version 3.1.7.6 or later. Ensure robust authentication and authorization mechanisms are in place for all login functionalities, especially social logins.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2021-24647 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2021-24647 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.