CVE-2021-4374

CRITICALNuclei

WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-4374 has a selected CVSS score of 9.1 (critical); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Sep 6, 2021 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 28, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WordPress Automatic Plugin

Browse ValvePress / WordPress Automatic Plugin

Default status: unaffected

CVE List, VulnCheckBefore 3.53.3affected

Proofs of concept

1

Catalogued exploits

MetasploitWordPress Plugin Automatic Config Change to RCEMetasploit auxiliary PoCby Jerome Bruandet +1 moreNot analyzed1 file

Ruby

Metasploit
PoC details

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Automatic Plugin - Unauthenticated Options ChangeCVSS 9.8

WordPress Automatic Plugin (versions 3.53.2 and below) contains a critical vulnerability that allows unauthenticated users to change arbitrary WordPress options through the process_form.php script. The vulnerable script uses update_option() on all POST parameters without authentication or capability checks, allowing attackers to create administrator accounts or modify critical settings. The vulnerability can be exploited even if the plugin is deactivated as it's a standalone script.

Impact

Unauthenticated attackers can update arbitrary WordPress options via process_form.php, enabling them to create administrator accounts, modify critical settings, or completely compromise the WordPress site.

Remediation

Upgrade to WordPress Automatic Plugin version 3.53.3 or later, or deactivate and delete the plugin.

WeaknessesCWE-862
Authorsintelligent-ears
Template tagscvecve2021wpwordpresswp-pluginwp-automaticunauthintrusivevkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:valvepress:wordpress_automatic_plugin:*:*:*:*:*:wordpress:*:*
Shodan: http.html:"wp-content/plugins/wp-automatic/"
FOFA: wp-content/plugins/wp-automatic/
Google: inurl:"/wp-content/plugins/wp-automatic/"
https://www.wordfence.com/blog/2021/09/critical-vulnerability-fixed-in-wordpress-automatic-plugin/ https://nvd.nist.gov/vuln/detail/CVE-2021-4374

Source: ProjectDiscovery

References

3