CVE-2021-27200: Wowonder

Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days.

In WoWonder 3.0.4, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.

Affected products

• Wowonder Wowonder: version 3.0.4 only

Published 2021-06-11. Last modified 2026-06-17.