CVE-2021-4413

MOYENNE 4.3CVE-2021-4413 · Published 12/07/2023 · updated 17/06/2026

En bref

CVE-2021-4413 est une vulnérabilité MOYENNE (CVSS 4.3) touchant process steps template designer (coolplugins).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.38%, plus élevée que 32.7% des vulnérabilités.
Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.

Package	Affected versions	Patched versions
process steps template designer coolplugins	`≤ 1.2.1`	No fix yet

Description

The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

References

blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks · Third Party Advisory
blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks · Third Party Advisory
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1 · Third Party Advisory
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2 · Third Party Advisory
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3 · Third Party Advisory
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4 · Third Party Advisory
blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5 · Third Party Advisory
plugins.trac.wordpress.org/changeset

Autres vulnérabilités de process steps template designer

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free