CVE-2021-24188: 
WordPress vulnerability analysis and mitigation

Multiple WP-Buy plugins were found to contain a vulnerability (CVE-2021-24188) that allows low-privileged users to install and activate arbitrary plugins from the WordPress repository. The vulnerability was discovered on April 22, 2021, affecting multiple plugins including wp-content-copy-protector, conditional-marketing-mailer, captchinoo-captcha-for-login-form-protection, wp-maintenance-mode-site-under-construction, tree-website-map, visitors-traffic-real-time-statistics, wp-limit-failed-login-attempts, and login-as-customer-or-user (WPScan).

The vulnerability exists in the AJAX action 'cp_plugins_do_button_job_later_callback' within the settings-start-index.php file. Attackers can exploit this through a POST request to /wp-admin/admin-ajax.php with specific parameters. The vulnerability has been assigned a CVSS score of 9.9 (critical) and is classified as an Access Control issue (CWE-284) (WPScan).

The vulnerability allows attackers to install any plugin, including specific versions, from the WordPress repository. This capability could be leveraged to install vulnerable plugins, potentially leading to more severe security issues such as Remote Code Execution (RCE). Additionally, the same AJAX action can be used to activate already installed plugins on the blog (WPScan).

The vulnerability can be exploited by sending a crafted POST request with either a 'slug' parameter for plugin installation or a 'plugin_file' parameter for plugin activation. The attack requires only low-privilege user access to execute (WPScan).

The vulnerability has been fixed in various versions of the affected plugins: wp-content-copy-protector (3.1.5), conditional-marketing-mailer (1.5.2), captchinoo-captcha-for-login-form-protection (2.4), wp-maintenance-mode-site-under-construction (1.8.2), tree-website-map (2.9), visitors-traffic-real-time-statistics (2.12), wp-limit-failed-login-attempts (2.9), and login-as-customer-or-user (1.8). Users should update to these or later versions (WPScan).