CVE-2021-4380

high-risk
Published 2023-06-07

The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.

Do I need to act?

!
80.7% chance of exploitation in next 30 days
EPSS score — higher than 19% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Valvepress

References (8)

Exploit https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-pinterest-...
Third Party Advisory https://wpscan.com/vulnerability/ffd344fd-de2c-4f27-8932-41aa0a3c3d05
Third Party Advisory https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-pinterest-automati...
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a29...
Exploit https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-pinterest-...
Third Party Advisory https://wpscan.com/vulnerability/ffd344fd-de2c-4f27-8932-41aa0a3c3d05
Third Party Advisory https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-pinterest-automati...
Third Party Advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a29...
57
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal