PT-2021-14234 · WordPress · Wordpress Email Template Designer - Wp Html Mail

Konan Nagashima · Published 2021-07-07 · Updated 2021-07-10 · CVE-2021-20779

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: WordPress Email Template Designer - WP HTML Mail versions prior to 3.0.8

Description: A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of administrators via unspecified vectors. This affects administrators and could lead to unauthorized actions on behalf of the administrator.

Recommendations: For versions prior to 3.0.8, update to version 3.0.8 or later to resolve the issue. As a temporary workaround, consider implementing additional authentication checks or restricting access to sensitive areas of the WordPress Email Template Designer - WP HTML Mail to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-20779

Affected Products

Wordpress Email Template Designer - Wp Html Mail

References · 7

• https://osv.dev/vulnerability/CVE-2021-20779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20779 · Security Note
• https://codemiq.com/en · Note
• https://t.me/cvenotify/17380 · Telegram Post
• https://t.me/cvenotify/17185 · Telegram Post
• https://wordpress.org/plugins/wp-html-mail · Note
• https://jvn.jp/en/jp/JVN42880365/index.html · Note