CVE-2021-4371

MEDIUM

WP Quick FrontEnd Editor <5.5 - Privilege Escalation

Title source: llm
STIX 2.1

Description

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lacking both a security nonce and a capabilities check. This makes it possible for low-authenticated attackers to change plugin settings even when they do not have the capabilities to do so.

References (3)

Core 3

Scores

CVSS v3 4.3
EPSS 0.0066
EPSS Percentile 47.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
labibahmed42/WP Quick FrontEnd Editor – WordPress Plugin < 5.5
pluginmirror/wp_quick_frontend_editor < 5.5
Published Jun 07, 2023
Tracked Since Feb 18, 2026