phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

CVE-2021-24752: Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

medium Affects catch-scroll-progress-bar (WordPress plugin), catch-sticky-menu (WordPress plugin), catch-themes-demo-import (WordPress plugin), catch-under-construction (WordPress plugin), catch-web-tools (WordPress plugin), essential-content-types (WordPress plugin) and 4 more. Feed 2026.10.29.1, updated 2026-10-28; published ; advisory modified .

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
catch-scroll-progress-bar (WordPress plugin) WordPress
Affected versions
<1.6
Fixed in
1.6
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
catch-sticky-menu (WordPress plugin) WordPress
Affected versions
<1.7
Fixed in
1.7
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
catch-themes-demo-import (WordPress plugin) WordPress
Affected versions
<1.6
Fixed in
1.6
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
catch-under-construction (WordPress plugin) WordPress
Affected versions
<1.4
Fixed in
1.4
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
catch-web-tools (WordPress plugin) WordPress
Affected versions
<2.7
Fixed in
2.7
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
essential-content-types (WordPress plugin) WordPress
Affected versions
<1.9
Fixed in
1.9
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
essential-widgets (WordPress plugin) WordPress
Affected versions
<1.9
Fixed in
1.9
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
generate-child-theme (WordPress plugin) WordPress
Affected versions
<1.6
Fixed in
1.6
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
header-enhancement (WordPress plugin) WordPress
Affected versions
<1.5
Fixed in
1.5
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

Multiple Plugins from the CatchThemes vendor do not perform capability and CSRF checks in the ctp_switch AJAX action, which could allow any authenticated users, such as Subscriber to change the Essent

Package
to-top (WordPress plugin) WordPress
Affected versions
<2.3
Fixed in
2.3
Severity
medium  CVSS 5.7
Exploitation
not on CISA KEV · EPSS 0% (36.4th percentile)
Published
2021-10-18
Source
nvd

References

CWE-284CWE-352
NVD recordcatch-scroll-progress-bar (WordPress plugin) advisoriescatch-sticky-menu (WordPress plugin) advisoriescatch-themes-demo-import (WordPress plugin) advisoriescatch-under-construction (WordPress plugin) advisoriescatch-web-tools (WordPress plugin) advisoriesessential-content-types (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs   How findings are ranked

Related advisories