CVE-2021-4428

LOW

What3words Autosuggest < 4.0.1 - Information Disclosure

Title source: rule

Description

A vulnerability has been found in what3words Autosuggest Plugin up to 4.0.0 on WordPress and classified as problematic. Affected by this vulnerability is the function enqueue_scripts of the file w3w-autosuggest/public/class-w3w-autosuggest-public.php of the component Setting Handler. The manipulation leads to information disclosure. The attack can be launched remotely. Upgrading to version 4.0.1 is able to address this issue. The patch is named dd59cbac5f86057d6a73b87007c08b8bfa0c32ac. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-234247.

Exploits (2)

gitlab WORKING POC
by Rekcah · poc
https://gitlab.com/Rekcah/cve-2021-4428
nomisec WRITEUP
by CERT-hr · poc
https://github.com/CERT-hr/Log4Shell

Scores

CVSS v3 2.7
EPSS 0.6862
EPSS Percentile 98.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
what3words/autosuggest < 4.0.1
Published Jul 18, 2023
Tracked Since Feb 18, 2026