CVE-2021-4388

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
wpopalOpal Estate<= 1.6.11

References

Timeline

Published
Jul 1, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-438805.5Windows Mobile Device Management Elevation of Privilege VulnerabilityCVE-2021-438829.8Microsoft Defender for IoT Remote Code Execution VulnerabilityCVE-2021-438837.8Windows Installer Elevation of Privilege VulnerabilityCVE-2021-438887.5Microsoft Defender for IoT Information Disclosure VulnerabilityCVE-2021-438897.2Microsoft Defender for IoT Remote Code Execution VulnerabilityCVE-2021-43894.3The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. This is due to missiCVE-2021-438907.1We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks thaCVE-2021-438917.8Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-438927.4Microsoft BizTalk ESB Toolkit Spoofing VulnerabilityCVE-2021-438937.5Windows Encrypting File System (EFS) Elevation of Privilege VulnerabilityCVE-2021-438965.5Microsoft PowerShell Spoofing VulnerabilityCVE-2021-438999.8Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability
CVE-2021-4388: Medium severity, CVSS 5.3 | Vulnix