CVE-2021-4380

The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.

• CWE-284

• https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-pinterest-automatic-plugin/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/ffd344fd-de2c-4f27-8932-41aa0a3c3d05Third Party Advisory
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-pinterest-automatic-pin-security-bypass-4-14-3/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a294-9a0fcb2de346?source=cveThird Party Advisory
• https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-pinterest-automatic-plugin/Exploit, Third Party Advisory
• https://wpscan.com/vulnerability/ffd344fd-de2c-4f27-8932-41aa0a3c3d05Third Party Advisory
• https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-pinterest-automatic-pin-security-bypass-4-14-3/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a294-9a0fcb2de346?source=cveThird Party Advisory

Published

Jun 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43793Discourse is an open source discussion platform. In affected…4.3
• CVE-2021-43794Discourse is an open source discussion platform. In affected…5.3
• CVE-2021-43795Armeria is an open source microservice framework. In affecte…7.5
• CVE-2021-43797Netty is an asynchronous event-driven network application fr…6.5
• CVE-2021-43798Grafana is an open-source platform for monitoring and observ…7.5
• CVE-2021-43799Zulip is an open-source team collaboration tool. Zulip Serve…9.8
• CVE-2021-43800Wiki.js is a wiki app built on Node.js. Prior to version 2.5…7.5
• CVE-2021-43801Mercurius is a GraphQL adapter for Fastify. Any users from M…7.5
• CVE-2021-43802Etherpad is a real-time collaborative editor. In versions pr…8.8
• CVE-2021-43803Next.js is a React framework. In versions of Next.js prior t…7.5
• CVE-2021-43804PJSIP is a free and open source multimedia communication lib…7.3
• CVE-2021-43805Solidus is a free, open-source ecommerce platform built on R…7.5