CVE-2021-4388

The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties.

• CWE-862
• CWE-862

• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/opal-estate/trunk/inc/ajax-functions.php#L177Not Applicable
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce729a2-a106-45ab-b96c-cfe75246def7?source=cveThird Party Advisory
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Exploit, Third Party Advisory
• https://plugins.trac.wordpress.org/browser/opal-estate/trunk/inc/ajax-functions.php#L177Not Applicable
• https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce729a2-a106-45ab-b96c-cfe75246def7?source=cveThird Party Advisory

Published

Jul 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43872Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43873Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43874Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-43875Microsoft Office Graphics Remote Code Execution Vulnerabilit…7.8
• CVE-2021-43876Microsoft SharePoint Elevation of Privilege Vulnerability8.8
• CVE-2021-43877ASP.NET Core and Visual Studio Elevation of Privilege Vulner…8.8
• CVE-2021-43880Windows Mobile Device Management Elevation of Privilege Vuln…5.5
• CVE-2021-43882Microsoft Defender for IoT Remote Code Execution Vulnerabili…9.8
• CVE-2021-43883Windows Installer Elevation of Privilege Vulnerability7.8
• CVE-2021-43888Microsoft Defender for IoT Information Disclosure Vulnerabil…7.5
• CVE-2021-43889Microsoft Defender for IoT Remote Code Execution Vulnerabili…7.2
• CVE-2021-4389The WP Travel plugin for WordPress is vulnerable to Cross-Si…4.3