The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_settings functions in versions up to, and including, 2.4. This makes it possible for unauthenticated attackers to change plugin settings and conduct attacks such as redirecting visitors to malicious sites.
References
| Link | Resource |
|---|---|
| https://blog.nintechnet.com/critical-vulnerability-in-wordpress-ultimate-gdpr-ccpa-compliance-toolkit-plugin/ | Exploit Technical Description Third Party Advisory |
| https://www.wordfence.com/threat-intel/vulnerabilities/id/40e2e8fb-ea36-4602-bead-8daf75d6dfb9?source=cve | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Jun 2023, 16:02
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CWE | CWE-601 | |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/40e2e8fb-ea36-4602-bead-8daf75d6dfb9?source=cve - Third Party Advisory | |
| References | (MISC) https://blog.nintechnet.com/critical-vulnerability-in-wordpress-ultimate-gdpr-ccpa-compliance-toolkit-plugin/ - Exploit, Technical Description, Third Party Advisory | |
| CPE | cpe:2.3:a:createit:ultimate_gdpr_\&_ccpa_compliance_toolkit:*:*:*:*:*:wordpress:*:* |
07 Jun 2023, 02:44
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-07 02:15
Updated : 2024-02-04 23:37
NVD link : CVE-2021-4348
Mitre link : CVE-2021-4348
CVE.ORG link : CVE-2021-4348
JSON object : View
Products Affected
createit
- ultimate_gdpr_\&_ccpa_compliance_toolkit
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')