CVE-2021-4405
The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epio_send_autosuggest_allowed() function. This makes it possible for unauthenticated attackers to send allowed parameters for autosuggest to elasticpress[.]io via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
We have discovered 6 live websites that are affected by CVE-2021-4405.
Affected Software
| Product | |
| Category | Wordpress Plugins |
| Vulnerable Versions |
|
| Total Vulnerable Versions | 8 |
| Vulnerable Domains | 6 live websites (15.79% of ElasticPress install base) |
Details
- Published - Jul 1, 2023
- Updated - Jul 1, 2023
Credits
- Jerome Bruandet (finder)
CVE References
CWE References
Countries
 United States | 1 websites |
 Hungary | 2 websites |
 Singapore | 2 websites |
 Netherlands | 1 websites |
TLDs
| .com | 3 websites |
| .nl | 1 websites |
Vulnerable Versions
Vulnerable versions are highlighted in redReferences
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8ab8eb9d-1427-4e99-8986-179147e0862e?source=cve
- https://blog.nintechnet.com/25-wordpress-plugins-vulnerable-to-csrf-attacks/
- https://blog.nintechnet.com/more-wordpress-plugins-and-themes-vulnerable-to-csrf-attacks/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-3/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-2/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-1/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-4/
- https://plugins.trac.wordpress.org/changeset/2473455/elasticpress/trunk/includes/classes/Feature/Autosuggest/Autosuggest.php
Websites affected by CVE-2021-4405
Top websites that are affected by CVE-2021-4405. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ***.***********.com | United States | ***,*** | |
| *****************.nl | Netherlands | ***,*** | |
| ***.***********.com | Singapore | *,***,*** | |
| ************.com | Singapore | *,***,*** | |
| *******.****.hu | Hungary | *,***,*** | |
| *******.****.hu | Hungary | *,***,*** |