PT-2023-12485 · WordPress · Wordpress Automatic Plugin

Jerome Bruandet · CVE-2021-4374 · Publicado 2023-06-07 · Atualizado 2025-11-13

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WordPress Automatic Plugin versions up to, and including, 3.53.2

Description The issue is caused by missing authorization and option validation in the process form.php file, allowing unauthenticated attackers to update site settings and potentially compromise the site.

Recommendations For versions up to, and including, 3.53.2, update to a version that includes the necessary authorization and validation fixes to prevent arbitrary options updates.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2021-4374

Produtos afetados

Wordpress Automatic Plugin

Referências · 6

• 🔥 https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-automatic-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2021-4374 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-4374 · Nota de Segurança
• https://twitter.com/pdnuclei_bot/status/1988804037089849421 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/d0567dc8-7a4c-42f4-bf45-f31a8efaa354?source=cve · Nota
• https://twitter.com/intel_ears/status/1988899666952372680 · Publicação no Twitter