PT-2023-12491 · WordPress · Pinterest Automatic

Jerome Bruandet

·

CVE-2021-4380

·

Publicado

2023-06-07

·

Atualizado

2025-10-01

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Pinterest Automatic plugin for WordPress versions up to, and including, 1.14.3
Description The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the wp pinterest automatic parse request function and the process form.php script. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.
Recommendations For versions up to, and including, 1.14.3, update to a version higher than 1.14.3 to resolve the issue. As a temporary workaround, consider disabling the wp pinterest automatic parse request function and restricting access to the process form.php script until a patch is available.

Exploit

Correção

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2021-4380

Produtos afetados

Pinterest Automatic