Vulnerability Description
The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Valvepress | Pinterest Automatic Pin | < 4.14.4 |
Related Weaknesses (CWE)
References
- https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-pinterest-ExploitThird Party Advisory
- https://wpscan.com/vulnerability/ffd344fd-de2c-4f27-8932-41aa0a3c3d05Third Party Advisory
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-pinterest-automatiThird Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a29Third Party Advisory
- https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-pinterest-ExploitThird Party Advisory
- https://wpscan.com/vulnerability/ffd344fd-de2c-4f27-8932-41aa0a3c3d05Third Party Advisory
- https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-pinterest-automatiThird Party Advisory
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a29Third Party Advisory
FAQ
What is CVE-2021-4380?
CVE-2021-4380 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' sc...
How severe is CVE-2021-4380?
CVE-2021-4380 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-4380?
Check the references section above for vendor advisories and patch information. Affected products include: Valvepress Pinterest Automatic Pin.