Cross-Site Request Forgery Vulnerability in Style Kits Plugin for WordPress
CVE-2021-4401

8.8HIGH

Key Information:

Vendor

WordPress
Status
Style Kits – Advanced Theme Styles For Elementor, Elementor Kits & Elementor Patterns
Vendor
CVE Published:
1 July 2023

What is CVE-2021-4401?

The Style Kits plugin for WordPress is susceptible to a Cross-Site Request Forgery (CSRF) attack due to improper nonce validation within the update_posts_stylekit() function. This vulnerability enables unauthenticated attackers to potentially alter style kits for posts by exploiting the administrator's action through a deceptive link, highlighting the importance of robust nonce checks to secure action calls.

Affected Version(s)

Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns 0 <= 1.8.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://blog.nintechnet.com/25-wordpress-plugins-vulnerab...
https://blog.nintechnet.com/more-wordpress-plugins-and-th...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jerome Bruandet
.