CVE-2021-4383: WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injection
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to edit/create any page or post on the blog.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-4383?
CVE-2021-4383 is a vulnerability in the WP Quick FrontEnd Editor plugin for WordPress that allows low-authenticated attackers to inject content into pages.
What is the severity of CVE-2021-4383?
The severity of CVE-2021-4383 is high, with a severity value of 4.3.
Which versions of WP Quick FrontEnd Editor plugin are affected by CVE-2021-4383?
Versions up to and including 5.5 of the WP Quick FrontEnd Editor plugin are affected by CVE-2021-4383.
How can low-authenticated attackers exploit CVE-2021-4383?
Low-authenticated attackers, such as subscribers, can exploit CVE-2021-4383 by injecting content into pages using the plugin's page-editing functionality.
Are there any resources for more information about CVE-2021-4383?
Yes, you can find more information about CVE-2021-4383 in the following resources: [Link 1](https://blog.nintechnet.com/multiple-vulnerabilities-in-wordpress-wp-quick-frontend-editor-plugin-unpatched/), [Link 2](https://wordpress.org/plugins/wp-quick-front-end-editor/#developers), [Link 3](https://www.wordfence.com/threat-intel/vulnerabilities/id/f5492bff-cfd9-41ed-a59b-4445d5e83e86?source=cve).