Cyber Resilience

CVE-2021-36888

Critical

Published: 15 December 2021

Published
15 December 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.6827 98.6th percentile
Risk Priority 61 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-36888 is a critical-severity Improper Access Control (CWE-284) vulnerability in Blocksera Image Hover Effects. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

blocksera
image hover effects
≤ 9.6.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-284 CWE-306

Device lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.

addresses: CWE-284 CWE-306

Explicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions.

addresses: CWE-284 CWE-306

Requiring authorization and configuration controls for mobile device connections directly enforces access control and prevents unauthorized devices from reaching organizational systems.

addresses: CWE-284 CWE-306

Provides a tamperproof, always-invoked, and verifiable mechanism to enforce access control policies.

addresses: CWE-284 CWE-306

Provides capability to review session content, directly detecting violations of access control.

addresses: CWE-284 CWE-306

Control assessments verify that access controls are implemented correctly and operating as intended, detecting improper access control before exploitation.

addresses: CWE-284 CWE-306

Certification requires independent assessment confirming access controls are implemented correctly and effective.

addresses: CWE-284 CWE-306

Restricting available functions and services reduces the attack surface and enforces proper access control boundaries.

References