PT-2023-12491 · WordPress · Pinterest Automatic

Jerome Bruandet · Published 2023-06-07 · Updated 2025-10-01 · CVE-2021-4380

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pinterest Automatic plugin for WordPress versions up to, and including, 1.14.3

Description The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the wp pinterest automatic parse request function and the process form.php script. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.

Recommendations For versions up to, and including, 1.14.3, update to a version higher than 1.14.3 to resolve the issue. As a temporary workaround, consider disabling the wp pinterest automatic parse request function and restricting access to the process form.php script until a patch is available.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-4380

Affected Products

Pinterest Automatic

References · 10

• 🔥 https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-pinterest-automatic-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2021-4380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4380 · Security Note
• https://twitter.com/pdnuclei_bot/status/1973281769303720125 · Twitter Post
• https://t.me/cvenotify/51946 · Telegram Post
• https://wpscan.com/vulnerability/ffd344fd-de2c-4f27-8932-41aa0a3c3d05 · Note
• https://t.me/cvenotify/51943 · Telegram Post
• https://acunetix.com/vulnerabilities/web/wordpress-plugin-pinterest-automatic-pin-security-bypass-4-14-3 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a294-9a0fcb2de346?source=cve · Note
• https://t.me/cibsecurity/65037 · Telegram Post