CVE-2021-4374: critical vulnerability in ValvePress WordPress Automatic Plugin
WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
70Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.1epss 16%
from disclosure to weaponsame day
Published on NVDJun 7
metasploitSep 6
VulnCheckSep 6
The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
ValvePress · WordPress Automatic PluginRelated CVEs — ValvePress WordPress Automatic Plugin
In the same product, most dangerous first.
CVE-2025-5395HIGHWordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File UploadEPSS 0.8%CVE-2024-4849MEDIUMWordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay ParameterEPSS 0.3%CVE-2025-6247MEDIUMWordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%