CVE-2021-4374

CRITICAL EXPLOITED NUCLEI

WordPress Automatic <3.53.2 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-4374 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including h00die, Jerome Bruandet, including a Metasploit module auxiliary/admin/http/wp_automatic_plugin_privesc. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated arbitrary WordPress options change vulnerability in the Automatic plugin (CVE-2021-4374) to enable user registration, set default user role to administrator, and create a new admin user.

Description

The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.

Exploits (1)

metasploit WORKING POC
by h00die, Jerome Bruandet · rubypocphp
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/wp_automatic_plugin_privesc.rb

This Metasploit module exploits an unauthenticated arbitrary WordPress options change vulnerability in the Automatic plugin (CVE-2021-4374) to enable user registration, set default user role to administrator, and create a new admin user.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target: WordPress Automatic Plugin <= 3.53.2
No auth needed
Prerequisites: WordPress site with vulnerable Automatic plugin installed · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

WordPress Automatic Plugin - Unauthenticated Options Change
CRITICALVERIFIEDby intelligent-ears
Shodan: http.html:"wp-content/plugins/wp-automatic/"
FOFA: wp-content/plugins/wp-automatic/

Scores

CVSS v3 9.1
EPSS 0.8002
EPSS Percentile 99.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2021-09-06
CWE
CWE-862
Status published
Products (2)
ValvePress/WordPress Automatic Plugin < 3.53.3
valvepress/wordpress_automatic_plugin < 3.53.2
Published Jun 07, 2023
Tracked Since Feb 18, 2026