CVE-2021-4401

Summary

CVE-2021-4401 represents a Cross-Site Request Forgery (CSRF) vulnerability in the Style Kits plugin for WordPress. Impacting versions up to and including 1.8.0, this issue stems from flawed nonce validation on the update_posts_stylekit() function. An attacker can exploit this defect by executing malicious requests, enabling them to update style kits for posts, even without authentication. This threat is particularly dangerous if an administrator is duped into performing a specific action, such as clicking on a crafted link.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.