4.3
Medium
CVE-2021-4405 The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,…
Description
The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epio_send_autosuggest_allowed() function. This makes it possible for unauthenticated attackers to send allowed parameters for autosuggest to elasticpress[.]io via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ElasticPress 3.5 | earliest → 3.5.3 | No fix stated |
Other CVEs of ElasticPress
The 4 CVEs of ElasticPress →
CVE-2026-62088
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded…
5.3
Medium
CVE-2024-35684
Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress:…
4.3
Medium
CVE-2023-48753
Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not…
5.3
Medium