WordPress Qubely < 1.8.6 - Unauthenticated Email Sending
CVE-2021-24916
Verified
Description
Qubely WordPress plugin < 1.8.6 contains an insecure deserialization caused by unauthenticated users being able to send arbitrary emails via the qubely_send_form_data AJAX action, letting attackers send spam or malicious emails, exploit requires no authentication.
Severity
High
CVSS Score
5.3
Exploit Probability
2%
Affected Product
qubely
Published Date
May 20, 2026
Template Author
roberto
CVE-2021-24916.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE ID:
cve-2021-24916
CWE ID:
cwe-284
Remediation Steps
Update to version 1.8.6 or later