CVE-2021-4392

The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. This is due to missing or incorrect nonce validation on the implecode_save_products_meta() function. This makes it possible for unauthenticated attackers to save product meta data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Exploit, Technical Description, Third Party Advisory
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Not Applicable
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2368356%40ecommerce-product-catalog&new=2368356%40ecommerce-product-catalog&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb963dd-41c3-43cd-afb7-1be054829ea3?source=cveThird Party Advisory
• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Exploit, Technical Description, Third Party Advisory
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Not Applicable
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2368356%40ecommerce-product-catalog&new=2368356%40ecommerce-product-catalog&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/2eb963dd-41c3-43cd-afb7-1be054829ea3?source=cveThird Party Advisory

Published

Jul 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43899Microsoft 4K Wireless Display Adapter Remote Code Execution …9.8
• CVE-2021-4390The Contact Form 7 Style plugin for WordPress is vulnerable …4.3
• CVE-2021-43905Microsoft Office app Remote Code Execution Vulnerability9.6
• CVE-2021-43907Visual Studio Code WSL Extension Remote Code Execution Vulne…9.8
• CVE-2021-43908Visual Studio Code Spoofing Vulnerability4.3
• CVE-2021-4391The Ultimate Gift Cards for WooCommerce plugin for WordPress…4.3
• CVE-2021-43925Improper neutralization of special elements used in an SQL c…9.8
• CVE-2021-43926Improper neutralization of special elements used in an SQL c…9.8
• CVE-2021-43927Improper neutralization of special elements used in an SQL c…9.8
• CVE-2021-43928Improper neutralization of special elements used in an OS co…8.8
• CVE-2021-43929Improper neutralization of special elements in output used b…5.4
• CVE-2021-4393The eCommerce Product Catalog Plugin for WordPress plugin fo…4.3