CVE-2021-4380

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Pinterest Automatic plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the 'wp_pinterest_automatic_parse_request' function and the 'process_form.php' script in versions up to, and including, 1.14.3. This makes it possible for unauthenticated attackers to update arbitrary options on a site that can be used to create new administrative user accounts or redirect unsuspecting site visitors.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
ValvePress	Pinterest Automatic	<= 4.14.3

References

https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-pinterest-automatic-plugin/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/ffd344fd-de2c-4f27-8932-41aa0a3c3d05Third Party Advisory
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-pinterest-automatic-pin-security-bypass-4-14-3/Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a294-9a0fcb2de346?source=cveThird Party Advisory
https://blog.nintechnet.com/critical-vulnerability-fixed-in-wordpress-pinterest-automatic-plugin/Exploit, Third Party Advisory
https://wpscan.com/vulnerability/ffd344fd-de2c-4f27-8932-41aa0a3c3d05Third Party Advisory
https://www.acunetix.com/vulnerabilities/web/wordpress-plugin-pinterest-automatic-pin-security-bypass-4-14-3/Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/e4fdc902-4cfe-4116-a294-9a0fcb2de346?source=cveThird Party Advisory

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-438007.5Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage CVE-2021-438017.5Mercurius is a GraphQL adapter for Fastify. Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending CVE-2021-438028.8Etherpad is a real-time collaborative editor. In versions prior to 1.8.16, an attacker can craft an `*.etherpad` file that, when imported, m CVE-2021-438037.5Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In o CVE-2021-438047.3PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SD CVE-2021-438057.5Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of se CVE-2021-438068.8Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does CVE-2021-438076.5Opencast is an Open Source Lecture Capture & Video Management for Education. Opencast versions prior to 9.10 allow HTTP method spoofing, all CVE-2021-438086.1Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) CVE-2021-438097.3`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33, when working with untrusted and a CVE-2021-43819.8The uListing plugin for WordPress is vulnerable to authorization bypass via wp_route due to missing capability checks, and a missing securit CVE-2021-438106.1Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is prese