Authorization Bypass Vulnerability in Pinterest Automatic Plugin for WordPress

CVE-2021-4380

What is CVE-2021-4380?

The Pinterest Automatic plugin for WordPress has a vulnerability that allows unauthorized users to bypass necessary authorization checks. Specifically, the 'wp_pinterest_automatic_parse_request' function and 'process_form.php' script lack proper capability validations. This oversight enables unauthenticated attackers to manipulate arbitrary site options, potentially creating new administrative accounts or redirecting legitimate visitors, compromising the integrity and security of the affected WordPress installations.

References