CVEvulnerability
CVE-2021-4388
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2023-07-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-862
Description
The Opal Estate plugin for WordPress is vulnerable to featured property modifications in versions up to, and including, 1.6.11. This is due to missing capability checks on the opalestate_set_feature_property() and opalestate_remove_feature_property() functions. This makes it possible for unauthenticated attackers to set and remove featured properties.
Affected configurations
• wpopal opal estate (<= 1.6.11)
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ Exploit, Third Party Advisory
- https://plugins.trac.wordpress.org/browser/opal-estate/trunk/inc/ajax-functions.php#L177 Not Applicable
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce729a2-a106-45ab-b96c-cfe75246def7?source=cve Third Party Advisory
- https://blog.nintechnet.com/multiple-wordpress-plugins-fixed-csrf-vulnerabilities-part-5/ Exploit, Third Party Advisory
- https://plugins.trac.wordpress.org/browser/opal-estate/trunk/inc/ajax-functions.php#L177 Not Applicable
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5ce729a2-a106-45ab-b96c-cfe75246def7?source=cve Third Party Advisory