9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
For a detailed advisory, download the pdf file here.
Around 400,000 sites were affected by several critical vulnerabilities(CVE-2021-34621, CVE-2021-34622, CVE-2021-34623, CVE-2021-34624) discovered in ProfilePress, a WordPress plugin. The vulnerabilities are easily exploitable which makes it possible for an adversary to gain admin access and upload arbitrary files to vulnerable sites without requiring any prior authentication. The frequent exploitation of the WordPress plugin makes it important for targeted websites admin to update the plugin to the latest available patched version 3.1.4.
CVE ID | Affected Versions | Vulnerability Name |
---|---|---|
CVE-2021-34621 | 3.0 – 3.1.3 | Unauthenticated Privilege Escalation |
CVE-2021-34622 | 3.0 – 3.1.3 | Authenticated Privilege Escalation |
CVE-2021-34623 | 3.0 – 3.1.3 | Arbitrary File Upload in Image Uploader Component |
CVE-2021-34624 | 3.0 – 3.1.3 | Arbitrary File Upload in Image Uploader Component |
<https://vulners.com/wpvulndb/WPVDB-ID:E12448EC-84A0-46AA-B280-5D9A80EE1E41>
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P