4.3
Moyenne
CVE-2021-4405 The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,…
Description
The ElasticPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.3. This is due to missing or incorrect nonce validation on the epio_send_autosuggest_allowed() function. This makes it possible for unauthenticated attackers to send allowed parameters for autosuggest to elasticpress[.]io via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ElasticPress 3.5 | premières → 3.5.3 | Pas de correctif indiqué |
Autres CVE de ElasticPress
Les 4 CVE de ElasticPress →
CVE-2026-62088
Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded…
5.3
Moyenne
CVE-2024-35684
Cross-Site Request Forgery (CSRF) vulnerability in 10up ElasticPress elasticpress.This issue affects ElasticPress:…
4.3
Moyenne
CVE-2023-48753
Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not…
5.3
Moyenne