CVE-2021-4396

The Rucy plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.4. This is due to missing or incorrect nonce validation on the save_rc_post_meta() function. This makes it possible for unauthenticated attackers to save post meta via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Third Party Advisory
• https://plugins.trac.wordpress.org/browser/rucy/trunk/inc/class-rucy-editor.php#L237Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/595d0401-55b9-418e-8b99-48b23e9a2662?source=cveThird Party Advisory
• https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/Not Applicable
• https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/Third Party Advisory
• https://plugins.trac.wordpress.org/browser/rucy/trunk/inc/class-rucy-editor.php#L237Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/595d0401-55b9-418e-8b99-48b23e9a2662?source=cveThird Party Advisory

Published

Jul 1, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43954The DefaultRepositoryAdminService class in Fisheye and Cruci…4.3
• CVE-2021-43955The /rest-service-fecru/server-v1 resource in Fisheye and Cr…4.3
• CVE-2021-43956The jQuery deserialize library in Fisheye and Crucible befor…6.1
• CVE-2021-43957Affected versions of Atlassian Fisheye & Crucible allowed re…7.5
• CVE-2021-43958Various rest resources in Fisheye and Crucible before versio…9.8
• CVE-2021-43959Affected versions of Atlassian Jira Service Management Serve…5.7
• CVE-2021-43960Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS v…4.8
• CVE-2021-43961Sonatype Nexus Repository Manager 3.36.0 allows HTML Injecti…4.3
• CVE-2021-43963An issue was discovered in Couchbase Sync Gateway 2.7.0 thro…8.1
• CVE-2021-43969The login.jsp page of Quicklert for Digium 10.0.0 (1043) is …6.5
• CVE-2021-4397The Staff Directory Plugin plugin for WordPress is vulnerabl…4.3
• CVE-2021-43970An arbitrary file upload vulnerability exists in albumimages…8.8