CVE-2021-4374

The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-automatic-plugin/Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d0567dc8-7a4c-42f4-bf45-f31a8efaa354?source=cveThird Party Advisory
• https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-automatic-plugin/Exploit
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d0567dc8-7a4c-42f4-bf45-f31a8efaa354?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4373The Better Search plugin for WordPress is vulnerable to Cros…4.3
• CVE-2021-43734kkFileview v4.0.0 has arbitrary file read through a director…7.5
• CVE-2021-43735CmsWing 1.3.7 is affected by a SQLi vulnerability via parame…9.8
• CVE-2021-43736CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RC…9.8
• CVE-2021-43737An issus was discovered in xiaohuanxiong CMS 5.0.17. There i…6.5
• CVE-2021-43738An issue was discovered in xiaohuanxiong CMS 5.0.17. There i…8.8
• CVE-2021-43741CMSimple 5.4 is vulnerable to Directory Traversal. The vulne…9.8
• CVE-2021-43742CMSimple 5.4 is vulnerable to Cross Site Scripting (XSS) via…5.4
• CVE-2021-43745A Denial of Service vulnerabilty exists in Trilium Notes 0.4…5.5
• CVE-2021-43746Adobe Premiere Rush versions 1.5.16 (and earlier) allows acc…5.5
• CVE-2021-43747Adobe Premiere Rush version 1.5.16 (and earlier) is affected…7.8
• CVE-2021-43748Adobe Premiere Rush versions 1.5.16 (and earlier) are affect…5.5