CVE-2021-4374: fallo crítico en ValvePress WordPress Automatic Plugin
WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
70Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.1epss 16%
de la publicación al armael mismo día
Publicada en NVD7 jun
metasploit6 sept
VulnCheck6 sept
The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. This is due to missing authorization and option validation in the process_form.php file. This makes it possible for unauthenticated attackers to arbitrarily update the settings of a vulnerable site and ultimately compromise the entire site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Productos afectados
ValvePress · WordPress Automatic PluginCVEs relacionadas — ValvePress WordPress Automatic Plugin
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-5395HIGHWordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File UploadEPSS 0.8%CVE-2024-4849MEDIUMWordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay ParameterEPSS 0.3%CVE-2025-6247MEDIUMWordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site ScriptingEPSS 0.2%