CVE-2021-4366

The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_features_options function in versions up to, and including, 1.7.32. This makes it possible for authenticated attackers to change the otherwise restricted settings within the plugin.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cveThird Party Advisory
• https://blog.nintechnet.com/wordpress-pwa-for-wp-and-amp-plugin-fixed-vulnerabilities/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/b38a51d7-375e-4cca-88ba-ccab796ac134Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a9892dd1-3939-41a9-a828-fa1bf7d96eb8?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43638Amazon Amazon WorkSpaces agent is affected by Integer Overfl…8.8
• CVE-2021-4364The JobSearch WP Job Board plugin for WordPress is vulnerabl…4.3
• CVE-2021-4365The Frontend File Manager plugin for WordPress is vulnerable…6.1
• CVE-2021-43650WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 p…9.8
• CVE-2021-43657A Stored Cross-site scripting (XSS) vulnerability via MAster…5.4
• CVE-2021-43659In halo 1.4.14, the function point of uploading the avatar, …5.4
• CVE-2021-43661totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to co…6.1
• CVE-2021-43662totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver …6.5
• CVE-2021-43663totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to co…7.5
• CVE-2021-43664totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to co…8.1
• CVE-2021-43666A Denial of Service vulnerability exists in mbed TLS 3.0.0 a…7.5
• CVE-2021-43667A vulnerability has been detected in HyperLedger Fabric v1.4…7.5