CVE-2018-21013

9.8 criticalEPSS 2.0%

Critical (9.8) in upperthemes swape. EPSS 2.0% chance of exploitation in the next 30 days.

The Swape theme before 1.2.1 for WordPress has incorrect access control, as demonstrated by allowing new administrator accounts via vectors involving xmlPath to wp-admin/admin-ajax.php.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2019-09-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

upperthemes:swape

References

https://wpvulndb.com/vulnerabilities/9024
https://wpvulndb.com/vulnerabilities/9024

Check your stack JSON