CVE-2021-24189

Name of the Vulnerable Software and Affected Versions: Captchinoo, Google recaptcha for admin login page WordPress plugin versions prior to 2.4

Description: The issue allows low-privileged users to exploit the AJAX action 'cp plugins do button job later callback' to install any plugin, including specific versions, from the WordPress repository and activate arbitrary plugins from the blog. This could lead to the installation of vulnerable plugins, potentially resulting in more critical vulnerabilities, such as remote code execution (RCE).

Recommendations: For versions prior to 2.4, update to version 2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the 'cp plugins do button job later callback' AJAX action to prevent low-privileged users from installing and activating arbitrary plugins.