CVE-2021-4413: Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery Bypass
The Process Steps Template Designer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the save() function. This makes it possible for unauthenticated attackers to save field icons via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4413?
The severity of CVE-2021-4413 is considered important due to its potential impact on the security of WordPress sites.
How do I fix CVE-2021-4413?
To fix CVE-2021-4413, you should update the Process Steps Template Designer plugin to version 1.2.2 or later.
Who is affected by CVE-2021-4413?
CVE-2021-4413 affects users of the Process Steps Template Designer plugin for WordPress running versions up to and including 1.2.1.
What type of vulnerability is CVE-2021-4413?
CVE-2021-4413 is a Cross-Site Request Forgery vulnerability that allows unauthenticated attackers to perform actions on behalf of users.
Can I exploit CVE-2021-4413 if I'm authenticated?
No, CVE-2021-4413 specifically allows unauthenticated attackers to exploit the vulnerability.