CVE-2021-4380
CRITICAL EXPLOITED NUCLEIPinterest Automatic <1.14.3 - Auth Bypass
Title source: llmExploitation Summary
CVE-2021-4380 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including halilkirazkaya. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains functional exploit code for multiple CVEs, including CVE-2021-4380, which involves an authorization bypass in the Pinterest Automatic WordPress plugin. The PoCs demonstrate how unauthenticated attackers can update arbitrary options, potentially leading to administrative account creation or redirection attacks.
Description
The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.
Exploits (1)
This repository contains functional exploit code for multiple CVEs, including CVE-2021-4380, which involves an authorization bypass in the Pinterest Automatic WordPress plugin. The PoCs demonstrate how unauthenticated attackers can update arbitrary options, potentially leading to administrative account creation or redirection attacks.
Nuclei Templates (1)
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H