CVE-2021-24133: 
WordPress vulnerability analysis and mitigation

The vulnerability CVE-2021-24133 affects the ActiveCampaign WordPress plugin versions below 8.0.2. This Cross-Site Request Forgery (CSRF) vulnerability was discovered in the plugin's Settings form and was publicly disclosed on September 6, 2020. The vulnerability was identified by Nguyen Anh Tien from SunCSR (Sun* Cyber Security Research) (WPScan).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue, identified as CWE-352. The security flaw exists due to the absence of CSRF checks in the Settings form of ActiveCampaign version 8.0.1 and earlier. The vulnerability has been assigned a CVSS score of 7.6 (High), indicating its significant severity. The issue falls under the OWASP Top 10 category A2: Broken Authentication and Session Management (WPScan).

When exploited, this vulnerability could allow an attacker to manipulate the plugin's settings and change API credentials to the attacker's account, provided they can get a logged-in administrator to access a specially crafted HTML page (WPScan).

The vulnerability has been fixed in ActiveCampaign version 8.0.2. Users are advised to update their ActiveCampaign plugin to this version or later to mitigate the security risk (WPScan).